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ABSTRACT 

Risk  and  reliability  assessment  of  aircraft  gas  turbine  engines  for  the  evaluation  of  component 
failure  has  received  increasing  interest  in  the  last  few  years,  fuelled  by  the  greater 
appreciation  of  stochastic  models  and  the  concern  for  airworthiness  issues.  This  report 
reviews  the  current  status  of  probabilistic  methods  available  for  the  risk  and  reliability 
assessment  of  gas  turbine  engines  and  the  potential  benefits  of  their  implementation  in  the 
military  environment.  The  definition  of  acceptable  risk  of  failure  in  the  military  standards  and 
the  current  relevant  activities  in  the  U.S  which  are  of  particular  interest  to  the  RAAF,  are  also 
discussed. 
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Review  of  Risk  and  Reliability  Methods  for 
Aircraft  Gas  Turbine  Engines 


Executive  Summary 


The  risk  and  reliability  assessment  of  aircraft  gas  turbine  engines  using  probabilistic 
methods  for  the  analysis  of  component  failure  is  a  recent  development  for  military 
aircraft.  The  increased  interest  has  resulted  from  greater  appreciation  of  stochastic 
models  and  the  current  concern  for  airworthiness  issues  of  aging  aircraft. 

There  are  several  current  activities  in  the  aerospace  industry  that  aim  to  reduce  the 
current  gap  between  the  risk  assumptions  of  the  safe  life  methodology,  the  military 
standards  and  the  operational  requirements  for  aircraft  gas  turbine  components.  These 
include  the  FAA  Titanium  Rotating  Components  Review  program,  the  U.S.  Air  Force 
Blade  Optimisation  program  and  the  annual  FAA/ Air  Force/NASA/Navy  workshops 
on  the  application  of  probabilistic  methods  to  gas  turbine  engines.  The  aim  of  these 
collective  activities  is  to  increase  the  capability  of  the  aerospace  industry  in 
probabilistic  methods  for  the  risk  and  reliability  assessment  of  critical  engine 
components. 

This  report  has  reviewed  the  issues  that  drive  the  change  away  from  a  deterministic 
towards  a  stochastic  approach  in  the  design  and  analysis  of  engine  component  lives. 
The  methods  and  programs  available  have  been  addressed.  Of  particular  interest  are 
the  modular  programs  resulting  from  collaboration  between  research  organisations 
and  the  OEMs.  Some  of  these  programs  incorporate  an  inspection  maintenance 
approach  and  thus  have  potential  use  when  a  Retirement  for  Cause  or  Damage 
Tolerance  approach  is  adopted  for  engine  components. 

The  dependence  of  risk  and  reliability  assessment  on  the  availability  of  engine  data  has 
been  discussed.  This  is  a  fundamental  issue  for  gas  turbine  engines  where  thermal, 
manufacturing  and  machining  effects  on  material  properties  need  to  be  taken  into 
consideration  in  understanding  the  failure  modes.  For  gas  turbine  engines  with 
military  applications,  databases  describing  material  properties  of  alloys  generally 
belong  to  OEMs  and  are  not  widely  available,  adding  further  difficulties  in 
determining  the  probability  density  functions  necessary  for  accurate  risk  and  reliability 
assessments. 

The  review  has  referred  to  the  military  standards  in  determining  what  is  the  acceptable 
risk  of  failure  of  gas  turbine  engine  components.  Although  estimates  of  the  acceptable 
risk  are  given  in  UK  DEF  STAN  00-971,  other  standards  lack  quantified  risk  limits. 

It  is  evident  that  risk  assessment  of  gas  turbine  engine  components  using  probabilistic 
methods  is  attracting  considerable  interest  and  effort  in  the  military  aviation 
community  and  a  move  away  from  the  use  of  deterministic  methods  towards  the 
implementation  of  stochastic  approaches  in  engine  lifing  is  in  progress. 


The  report  has  highlighted  areas  in  need  of  further  research,  including  the  effects  of 
multiple  failure  modes  incorporating  creep  and  oxidation  effects  on  risk  of  failure  for 
engine  components,  and  the  development  of  engine  system  risk  models. 
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1.  Introduction 


An  important  issue  of  concern  to  the  ADF,  like  other  military  aircraft  operators,  is  the 
element  of  risk  in  the  operating  environment  due  to  engine  component  failure.  Specific 
concerns  are: 

•  What  is  the  risk  of  flying  an  aircraft, 

•  What  is  the  acceptable  flight  failure  limit,  and  therefore 

•  How  can  the  risk  of  flying  an  aircraft  be  managed  by  the  ADF? 

Probabilistic  methods  can  be  used  to  address  the  first  issue,  an  important  step  towards 
risk  management. 

Military  aircraft  engine  components  have  traditionally  been  lifed  by  the  Original 
Equipment  Manufacturer  (OEM)  using  the  safe  life  method.  The  risk  of  continuing 
operation  of  an  engine  component  beyond  its  safe  life  has  been  questioned  in 
circumstances  of  high  cost  of  component  replacement  or  of  component  scarcity.  The 
quantification  of  risk  is  desirable  for  decision  making  at  operational  level.  It  would 
also  allow  a  means  of  comparison  with  the  risk  of  failure  requirements  described  in 
the  military  standards  for  engines.  Risk  assessment  can  contribute  to  the 
implementation  of  Retirement  for  Cause  for  engine  components  by  defining  the 
inspection  interval  for  an  acceptable  risk  level.  There  is  therefore  great  potential  in  the 
implementation  of  risk  and  reliability  methods  for  the  management  of  military  engine 
components. 

Risk  is,  in  this  context,  the  probability  of  failure  within  the  service  life  of  the 
engine/ component  while  reliability  is  the  probability  of  the  engine /component  not 
failing  during  service.  The  term  Risk  and  Reliability  (R&R)  assessment  will  be  used  in 
this  report  to  describe  the  determination  of  the  probability  of  failure  /  survival  of  an 
engine  component.  The  methods  examined  in  this  review  are  mostly  probabilistic  and 
the  term  probabilistic  assessment  will  be  used  interchangeably  with  R&R. 

This  report  reviews  important  issues  arising  from  the  application  of  R&R  methods  to 
gas  turbine  engine  components.  The  contemporary  view  on  the  safe  life  method  will 
be  addressed  and  the  move  from  deterministic  to  probabilistic  approaches  in  the 
design/lifing  of  engine  components  will  be  discussed.  Important  activities  initiated  by 
the  FAA  and  the  U.S  Air  Force  will  be  presented. 

Computational  methods  are  briefly  described.  The  report  places  emphasis  on  the  data 
input  requirements  for  R&R  programs  and  discusses  the  problems  due  to  scarcity  of 
data  and  means  of  overcoming  them.  Programs  developed  specifically  for  gas  turbine 
engine  components  and  generic  programs  of  potential  benefit  are  listed  and  examples 
of  their  application  are  given.  Areas  where  limited  information  is  available  in  the 
literature  are  listed. 

This  report  aims  to  describe  not  only  the  status  of  risk  and  reliability  assessment  of  gas 
turbine  engines  but  also  the  trends  in  the  aircraft  industry  and  the  U.S.  military  that 
may  affect  ADF  management  of  engine  components  in  the  future. 
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2.  Need  for  Risk  and  Reliability  Analysis 


As  Cruse  et  al  (1997)  state,  the  safe  life  design  philosophy,  led  by  companies  such  as 
Pratt  &  Whitney  and  Rolls-Royce,  has  been  the  basis  of  aircraft  engine  design  today.  A 
brief  history  of  the  development  of  the  safety  factor  concept,  where  a  safety  factor  is 
applied  to  the  design  loads  to  provide  a  safety  margin  in  safe  life,  is  given  by  Goldberg 
and  Verderaime  (1999).  The  safe  life  philosophy  has  been  used  by  OEMs  to  determine 
the  number  of  flight  cycles  before  cracking  can  be  expected  at  a  low  probability  of 
occurence,  and  to  use  that  minimum  life  to  certify  the  aircraft  engine  components. 
Engine  components  are  retired  at  a  life  that  has  a  one  in  a  thousand  chance  of  a  1/32" 
crack  developing  in  that  time. 

A  number  of  concerns  have  led  to  the  investigation  of  alternative  approaches  to 
determining  engine  disk  life.  In  one  instance  it  was  found  that  stresses  in  engine  disks 
had  not  been  adequately  calculated  in  the  early  design  periods,  before  finite  element 
methods  were  available,  and  several  disks  failed  short  of  their  initial  design  life  [Cruse 
et  al  1997].  In  addition,  the  inherent  cost  associated  with  the  safe  life  approach  due  to 
the  wasting  of  expensive  uncracked  components  became  an  issue.  The  Damage 
Tolerance  and  Retirement  for  Cause  methods  were  examined  by  the  U.S.  Air  Force. 
The  first  was  initially  found  inappropriate  for  engine  material  alloys,  setting  an 
excessively  short  inspection  interval.  The  latter  exposed  issues  associated  with 
probabilistic  fracture  mechanics  and  the  liability  of  missing  a  crack  at  inspection  [Cruse 
et  al  1997],  Since  1984,  Damage  Tolerance  forms  an  integral  part  of  the  ENgine 
Structural  Integrity  Program  (ENSIP),  contained  in  MIL-STD-1783.  There  is  now  a 
program  in  the  U.S.  to  incorporate  guidelines  for  application  of  probabilistic  methods 
for  gas  turbine  engines  in  the  ENSIP  by  2006  [Brown  2001], 

The  philosophy  and  implications  of  introducing  Damage  Tolerance  concepts  into  the 
design  and  use  of  critical  engine  components  were  discussed  by  AGARD  in  1985 
[N.A.T.O  1985].  The  Damage  Tolerance  philosophy  was  stated  to  offer  potential  cost 
savings  of  considerable  magnitude  when  compared  with  a  'safe-life'  approach,  if  only  it 
can  be  implemented  with  an  assurance  that  current  safety  standards  will  not  be 
prejudiced.  It  was  estimated  that  over  80 %  of  engine  disks  have  10  or  more  low  cycle  fatigue 
lives  remaining  when  discarded  under  'safe-life'  rules. 

Development  of  Retirement  For  Cause  or  "fly  to  a  safe  crack"  approach  allows  periodic 
inspection  of  each  disk  so  that  the  only  disks  that  are  retired  are  ones  with  detected 
cracks  [Bartsch  1985,  Ohnabe  et  al  1985].  This  method  requires  that  an  optimal 
inspection  interval  should  be  determined.  Probabilistic  methods  can  be  used  to 
determine  the  fatigue  reliability  of  engine  components  under  scheduled  inspection 
maintenance  and  also  the  optimum  inspection  interval  for  a  certain  risk  level. 

For  commercial  gas  turbine  engines  both  Damage  Tolerance  and  Retirement  For  Cause 
methods  have  been  adopted.  During  early  1980's,  the  FAA  accepted  a  Probabilistic 
Risk  Assessment  (PRA)  using  an  in-service  Retirement  For  Cause  program,  the  success 
of  which  lead  to  the  adoption  of  PRA  by  the  FAA  for  commercial  engine  disks  [Cruse 
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et  al  1997].  When  an  in-service  cracking  problem  occurs,  FAA  requires  probabilistic 
fracture  mechanics  and  risk  assessment  so  that  no  commercial  engine  is  flying  with  a 
significant  crack  size,  rather  than  grounding  all  engines  until  the  components  are 
replaced. 

Military  authorities,  including  the  ADF,  have  generally  been  slow  in  adopting  a  similar 
approach  and  prefer  to  ground  the  fleet  and  replace  components  following  in-flight 
cracking.  As  Koul  et  al  (1985)  describe,  lack  of  replacement  components  can  initiate  a 
damage  tolerance  approach.  Such  an  example  is  the  J85-CAN40  engine  where  the 
reduction  of  the  safe  life  limits  by  the  OEM  resulted  in  insufficient  numbers  of 
replacement  components  being  available,  and  a  damage  tolerance  approach  had  to  be 
implemented. 

The  question  of  validity  of  the  manufacturer's  analytical  life  predictions  for  the  safe  life 
of  engine  components  has  been  raised  by  many  authors  but  has  not  been  answered 
adequately  [Mahorter  et  al  1985b,  Singpurwalla  1988],  Researchers  that  utilised  spin 
pit  testing  to  experimentally  obtain  the  life  of  components  compared  their  findings 
with  the  safe  life  predictions  which  gave  antithetic  and  inconclusive  results  [Mahorter 
et  al  1985b,  Metis  and  Zaretsky  1999]. 

The  conservative  lifing  of  OEM  analytical  models  was  investigated  in  a  study  by 
Mahorter,  London,  Fowler  and  Salvino  (1985)  that  produced  spin-pit  results  for  time  to 
crack  initiation  for  compressor  disks.  The  accuracy  of  the  safe  life  prediction  for 
military  applications  was  questioned  when  only  a  very  small  proportion  of  engine 
components  'fail'  at  the  predicted  life. 

Singpurwalla  (1988)  states  that  aircraft  manufacturers'  analytical  life  models  for  engine 
components  have  been  quoted  to  produce  conservative  predictions  of  up  to  50%  for 
two  main  reasons,  the  desire  for  increased  safety  and  the  drive  for  increased  number  of 
components  sold.  He  states  that  OEM  analytical  models  are  company  confidential  and 
based  on  a  large  number  of  specimen  tests  of  material  properties;  one  example  quoted 
300  specimens.  It  is  certain  that  OEM  material  databases  would  be  of  great  benefit  to 
research  in  component  failures  and  risk  assessment  of  engine  components,  as  also 
concluded  in  the  DSTO  study  of  the  TF30  engine  [Tong  and  Kappas  2002]. 

An  additional  element  that  affects  the  turbine  rotors'  life  is  the  material  and 
manufacturing  anomalies,  which  occur  infrequently  and  most  likely  are  not  accounted 
for  in  laboratory  specimens  and  full-scale  component  testing  that  is  used  to  determine 
the  safe  life.  These  undetected  anomalies  have  lead  to  several  incidents  including  the 
loss  of  the  DC-10  at  Sioux  City  in  1989  [AIARI  Sub-Committee  1997]. 

According  to  Berens  (1996),  today’s  aging  military  aircraft  are  exceeding  their  designed 
life  and  are  being  used  in  their  wear  out  phase.  He  promotes  R&R  methodology  as  one 
possible  tool  for  making  cost  effective  decisions  about  inspections,  repair  and  life 
extension  of  military  aircraft. 

Cole  (1998),  among  others,  challenges  the  validity  of  the  "constant  failure  rate"  theory, 
and  the  expectation  that  failures  on  a  fully  developed  engine  come  only  from  the 
'random'  region  of  the  bathtub  curve.  He  therefore  questions  the  reliability  targets 
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defined  in  the  Failure  Modes,  Effects  and  Criticality  Analysis  (FMECA),  where  the 
system  failure  rate  is  determined  as  a  simple  sum  of  component  failure  rates.  He  refers 
to  the  example  of  LCF  failures  where  there  is  an  observed  increasing  failure  rate  with 
time. 

As  Melis  and  Zaretsky  (1999)  state,  deterministic  methods  assume  that  full  and  certain 
knowledge  exists  for  service  conditions  and  material  properties.  Deterministic  failure 
mode  analysis  has  been  described  by  Moore,  Ebbeler  and  Creager  (1990)  as  either  non¬ 
representative  of  the  conditions  during  the  flight,  too  conservative  by  the  application  of 
safety  factors,  or  inaccurate  due  to  limited  information  and  uncertain  knowledge.  They 
further  state  that  the  inaccuracy  of  engineering  models  used  in  deterministic  analyses 
to  describe  sometimes-complex  failure  phenomena  may  produce  uncertain  results 
[Moore  et  al  1990]. 

As  explained  in  [Lust  and  Wu  1998,  Xiaoming  et  al  1998],  the  non-deterministic  nature 
of  fatigue  failure  stems  from  material  and  geometric  tolerance  uncertainties, 
environmental  conditions,  uncertainty  in  service  loading  and  unintended  use,  as  well 
as  variations  in  manufacturing  and  assembly  processes.  Probabilistic  assessment  of 
failure  risk  allows  the  quantification  of  the  uncertainties  or  variability  affecting  failure 
of  a  structure  or  a  component. 

A  number  of  researchers  discuss  probabilistic  methods  that  are  applicable  to  situations 
when  information  describing  failure  is  difficult  or  expensive  to  acquire.  The  aerospace 
industry  has  acknowledged  the  significant  influence  of  uncertainties  present  in  loads, 
material  behaviour  and  geometric  configuration,  and  has  developed  probabilistic 
structural  analysis  methods,  some  of  which  are  generic  in  nature  and  can  be  applied  to 
aircraft  and  engine  reliability  [Moore  et  al  1990,  Shah  et  al  1992]. 

As  described  by  Moore,  Ebbeler  and  Creager  (1990),  the  urgent  need  for  improved 
approaches  to  managing  failure  in  launch  vehicle  propulsion  systems  has  been 
addressed  by  the  introduction  of  probabilistic  methods  for  quantitatively  assessing 
failure  risk  [Moore  et  al  1990].  The  authors  mention  the  limitations  of  past  practices  in 
engineering  areas  that  used  judgemental  evaluation  based  on  limited  test  experience 
and  deterministic  engineering  analysis.  The  aircraft  industry  today  is  in  a  similar 
position  and  is  slowly  moving  into  probabilistic  assessment  of  failure. 

One  area  where  probabilistic  methods  have  been  adopted  early  in  the  design  phase  is 
in  the  use  of  ceramic  materials.  The  recent  development  of  ceramic  components  for  gas 
turbine  engines  required  a  departure  from  the  usual  deterministic  design  philosophy 
due  to  the  large  variability  in  ceramics'  material  properties.  Consequently, 
probabilistic  methods  have  been  readily  adopted  for  ceramic  component  reliability 
[Powers  et  al  1992].  The  introduction  of  R&R  methods  at  the  design  and  development 
phase  is  being  increasingly  recommended  in  the  aircraft  and  aerospace  industry 
because  of  the  inherent  uncertainties  and  the  cost  advantages  of  reduced  conservatism 
[Moore  et  al  1992b,  AIARI  Sub-Committee  1997], 

Moore,  Ebbeler  and  Creager  (1990)  mention  that  parallel  to  the  increasing  need  to 
implement  probabilistic  methods  in  R&R  analysis,  there  is  still  the  need  to  determine 
the  origins,  mechanisms  and  consequences  of  known  failure  modes.  Understanding 


4 


DSTO-TR-1306 


tlic  nature  of  failure  modes  provides  a  foundation  for  failure  models  and  a  small 
number  of  studies  have  been  conducted  with  the  aim  of  achieving  that  for  gas  turbine 
engines  [Cruse  et  al  1997,  Leverant  et  al  1997]. 

Therefore  the  need  for  R&R  assessment  of  gas  turbine  engines  is  not  only  driven  by 
alternative  lifing  methods,  Damage  Tolerance  and  Retirement  For  Cause,  but  follows 
the  developments  in  commercial  engines  and  aerospace  industries  which  are  replacing 
deterministic  methods  with  stochastic/probabilistic  approaches  to  engine  lifing  and 
engine  failure  assessment.  This  change  in  attitude  became  obvious  following  the  1989 
Sioux  City  accident,  when  the  Federal  Aviation  Administration  (FAA)  Titanium 
Review  Team  recommended  the  introduction  by  industry  of  additional  damage 
tolerance  concepts  to  reduce  the  rate  of  uncontained  rotor  events  related  to  material 
anomalies  [AIARI  Sub-Committee  1997].  This  recommendation  has  spurred  a  great 
effort  towards  a  fracture  mechanics-based  probabilistic  analysis  of  all  new  critical  gas 
turbine  engine  components.  It  has  added  Damage  Tolerance  to  the  OEM  existing 
design  and  life  management  process  acknowledging  the  effect  of  inherent, 
manufacturing  and  maintenance  induced  material  anomalies.  Although  it  does  not 
replace  the  Safe  Life  method,  it  introduces  probabilistic  methods  to  complement  it. 
Similarly  the  Blade  Optimisation  Program  running  in  parallel  to  the  FAA  program, 
was  initiated  in  1990  by  the  U.S.  Air  Force  Research  Laboratory  with  engine  OEMs  to 
implement  probabilistic  methods  in  the  design  of  gas  turbine  components  in  order  to 
reduce  weight  and  increase  durability.  The  results  of  the  program  will  be  incorporated 
as  guidelines  in  the  ENSIP.  Such  programs  show  the  increased  interest  and  use  of  R&R 
in  the  last  decade,  supported  by  the  military  and  aviation  authorities. 


2.1  Statistical  Failure  Assessment  and  Certification 

Certification  of  flight  readiness  has,  in  the  past,  used  certification  rules  with  no  formal 
rationale  based  on  statistics  or  engineering  analysis,  for  both  commercial  and  military 
sectors  [Moore  et  al  1990],  Such  an  example  in  aircraft  engine  components  is  the  LCF 
life  prediction  based  on  the  initiation  life  [Mahorter  et  al  1985b,  Cruse  et  al  1997].  The 
engine  part  life,  also  called  B.l  life,  is  the  LCF  life  defined  by  a  crack  growing  to  1/32 
inch  in  any  of  the  critical  areas  with  a  one  in  a  thousand  chance.  The  accuracy  of  the 
LCF  life  times  and  the  appropriateness  of  the  B.l  level  have  been  questioned.  The 
wastage  of  non-cracked  parts  at  the  end  of  their  LCF  life  also  raises  the  question  of 
expenses  [Mahorter  et  al  1985b]. 

Cole  (1998)  describes  the  developments  in  statistical  failure  analysis  of  aero  gas 
turbines.  The  initial  requirements  for  certification  of  aircraft  originated  for  the 
Concorde  and  the  Tornado  in  the  1960s.  These  have  expanded  to  the  safety  and 
reliability  levels  that  have  become  contractually  binding  for  the  EJ200  in  the 
Eurofighter  in  the  1990s.  The  use  of  the  'hazard  matrix’  for  safety,  according  to  the 
author,  is  increasingly  becoming  mandatory  in  American  and  UK  military  contracts. 
Cole  (1998)  lists  as  examples  of  its  use,  the  Pegasus  in  the  Harrier  and  Tornado  military 
aircraft.  An  example  of  the  hazard  matrix  for  safety  can  be  seen  in  Figure  1,  showing 
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the  bands  for  quantitative  probability  and  qualitative  severity  levels  as  set  by  DEF 
STAN  00-971  (1987).  Clearly,  the  implementation  of  such  a  matrix  requires  means  of 
quantifying  the  probability  of  failure. 

Probabilistic  failure  risk  assessment  necessitates  the  use  of  acceptable  risk  criteria  for 
the  evaluation  of  numerical  results.  Most  reports  in  this  review  describe  results  for 
assessment  of  probability  of  component  failure  but  the  underlying  question  of  'what  is 
acceptable'  is  not  always  answered.  Often  in  the  literature,  the  acceptable  risk  of  10  6  is 
mentioned,  without  providing  the  source  or  reason  for  the  selection  of  this  criterion 
[Berens  1996,  Szekely  et  al  1998].  During  the  First  Annual  Probabilistic  Methods 
Conference  it  was  strongly  stated  that  probabilities  acceptable  for  failure  limits  need  to 
be  defined  [Brown  2001,  Rogers  2001]. 

A  unique  example  of  setting  risk  targets  for  titanium  rotating  components  is  the  recent 
study  generated  by  the  FAA  Titanium  Rotating  Components  Review  following  the 
1989  Sioux  City  accident.  Design  Target  Risk  (DTR)  values  were  set  by  an  industry 
committee  to  determine  the  acceptability  of  new  titanium  rotating  design  components. 
The  DTR  values  were  determined  at  component  and  engine  levels,  in  terms  of 
events/part  cycle,  so  that  component  re-design  would  be  implemented  when  these 
values  are  exceeded  [ALARI  Sub-Committee  1997], 

2.1.1  Engine  certification 

UK  and  US  Military  standards  provide  guidelines  for  engine  certification.  USAF  MIL- 
STD-1783  (1984)  describes  requirements  for  ENSIP,  safety  and  durability.  It  includes 
safety  factors  as  part  of  design  development  and  verification  and  Damage  Tolerance 
requirements  (USAF).  It  does  not  specify  acceptable  levels  of  probability  of  failure 
other  than  those  implied  through  the  safety  factor  design  method. 

US  MIL-STD-882C  (1993)  describes  the  process  by  which  a  hazard  risk  assessment  matrix 
is  produced  for  military  systems.  The  standard  states  that  decisions  regarding  hazard 
severity,  hazard  prioritisation  and  acceptable  levels  of  probability  of  failure  must  be 
agreed  between  the  military  party  and  the  contractor  assessing  the  failure  of  the 
military  system.  This  reference  only  provides  general  guidelines  in  producing  the  risk 
assessment  matrix  and  an  engineering  assessment  is  then  necessary  to  quantify  the 
acceptable  risk  criterion. 

The  UK  DEF  STAN  00-971  (1987)  for  aircraft  gas  turbine  engines  provides  guidelines 
for  engine  certification  in  terms  of  reliability.  It  states  that  a  Failure  Mode  and  Effect 
Analysis  (FMEA)  for  the  complete  engine  should  "assess  the  likely  consequences  of  all 
failure  modes  that  can  be  reasonably  expected  to  occur".  The  failures  that  could  result 
in  a  severity  of  effect  greater  than  minor  should  contain  an  estimate  of_  the  probabilities  of 
occurrence  of  those  failures,  in  terms  of  'reasonably  probable',  'remote'  or  'extremely 
remote'. 

The  classification  of  the  failure  modes,  effects  and  acceptable  risk  levels  described  in 
ANNEX  B  of  DEF  STAN  00-971  (1987),  is  summarised  in  Figure  1,  for  military  non¬ 
passenger  aircraft.  For  passenger  carrying  transport  aircraft  the  probability  of  failure 
limits  are  tighter,  as  greater  loss  of  life  is  at  risk. 
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The  effect  of  failure  is  classified  as  minor,  major  and  hazardous  and  the  last  of  these  is 
allowed  an  extremely  remote  chance  of  occurring.  For  engine  certification  of  non¬ 
passenger  aircraft,  it  is  acceptable  that  for  the  likelihood  of  a  hazardous  event,  such  as 
non-containment  of  energy  debris,  the  probability  of  occurrence  should  not  be  greater  than 
IQ*  per  hour  of  flight.  It  is  the  effect  (hazardous)  therefore  and  not  the  cause  (eg  disk 
fracture)  that  is  used  for  assessing  certification.  For  an  engine  system,  a  number  of 
components,  and  therefore  critical  locations,  can  contribute  to  an  individual  failure  of 
hazardous  effect;  hence  the  calculation  of  the  system  risk  limit  of  106  per  hour  of  flight 
for  a  particular  engine  can  be  a  difficult  exercise.  The  issues  involved  in  determining 
engine  system  risk  and  applying  the  DEFSTAN  00-971  criteria  are  further  discussed  in 
a  report  by  Kappas  and  Antoniou  (2002). 


Probability  of  failure  perflit 

fht  hour 

DEFSTAN  00-971 
Classification  of  effect 
of  engine  fai lure 

Reasonably  Probable 
(once  or  several  times 
during  life  of  aircraft) 

lOHolO-4 

Remote 

( several  times  during  total 
life  of  number  of  aircraft) 

104tolO-5 

Extremely  Remote 

(unlikely  to  occur  during  total 
life  of  number  of  aircraft) 

lOHolO-7 

Hazardous  effect 

Death  or  serious  injury  of 
occupants 

Large  reduction  in  safety  margins 

Crew  unable  to  perform  tasks 
accurately  or  completely 

SIS  UNACCEPTj4 

km 

Major  effect 

Injury  to  occupants,  Significant 
reduction  in  safety  margins,  reduction  in 
ability  of  aircrew  to  perform  under 
adverse  operating  conditions 

lit- 

ACC1 

EPTABLE 

Minor  effect 

Physical  effects  but  no  injury  to  occupant! 
Slight  reduction  of  safety  margins 

Slight  increase  in  workload 

Figure  1  Hazard  matrix  showing  the  classification  of  effect  of  engine  failure  [UK  DEF 
STAN  00-971  1987] 


3.  Probabilistic  Methods 

According  to  Lepikhin,  Moskvichev  and  Doronin  (1998),  there  are  three  ways  to  assess 
risk: 

1 .  Data-base  approach,  extrapolate  past  failure  data, 

2.  Probabilistic  engineering  analysis  with  probabilistic  fracture  mechanics  (PFM)  as  a 
subset, 

3.  Combined  database  and  PFM. 
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Probabilistic  engineering  analysis  may  include  the  probabilistic  life  prediction  of  crack 
initiation,  not  covered  by  PFM.  The  programs  considered  in  this  review,  implement 
PFM  either  by  using  stochastic  models  of  crack  growth  or  by  using  deterministic  crack 
growth  models  with  probability  density  functions  describing  the  variability  in 
component  life  and  material  properties. 

3.1  Probabilistic  Engineering  Analysis 

3.1.1  Probabilistic  fracture  mechanics 

The  probabilistic  fracture  mechanics  approach  involves  probabilistic  assessment  of 
fatigue  crack  growth  from  initial  to  critical  size,  assuming  an  initial  crack  size  and 
ignoring  initiation  life  [Yang  et  al  1983,  Graham  and  Mallinson  1984], 

Various  probabilistic  fracture  mechanics  models  described  in  the  literature  introduce 
stochastic  parameters  into  empirical  crack  growth  models  [Yang  et  al  1983,  Ohnabe  et 
al  1985,  Provan  1987,  Min  and  Xiong  1992,  Moore  et  al  1992b,  Cruse  et  al  1997, 
Orisamolu  and  Luo  1997].  Cruse  et  al  (1997)  describe  a  stochastic  interpretation  of  the 
Paris  law  where  the  Paris  exponent  n  is  constant  and  the  Paris  constant  C  is 
lognormally  distributed.  Other  researchers  use  the  Paris  law  with  both  n  and  C  as 
jointly  distributed  random  variables  [Provan  1987,  Min  and  Xiong  1992].  It  is  clear  that 
material  crack  growth  data  has  to  be  available  to  justify  the  choice  of  the  type  and 
value  of  the  distribution  function  used  for  the  stochastic  parameters  in  the  empirical 
models. 

An  example  of  how  a  deterministic  model  can  become  stochastic  is  described  by 
Ohnabe  et  al  (1985),  where  a  random  variable  Z  is  introduced  in  the  lognormal  crack 
growth  rate  model  (equation  1).  Z  is  the  product  of  random  variables  that  contribute  to 
the  scatter  in  crack  growth  (equation  2).  The  random  variables  Hi,  H2,  H3,  H4,  describe 
variability  in  material,  crack  geometry,  crack  modelling  and  crack  growth  damage,  and 
S  describes  the  variability  in  stress  due  to  service  loads  and  the  temperature  profile  and 
are  each  represented  by  lognormal  distributions. 

dt 

Z  =  H,H2H,HaSv 
where  Q,  b  and  V  are  constants. 

Langley  (1989)  assessed  a  number  of  stochastic  crack  growth  models,  under  constant 
amplitude  loading  and  incorporating  various  density  functions,  against  a  set  of 
experimental  data.  The  results  demonstrated  the  difficulties  in  the  development  of  a 
crack  growth  model  because  although  the  models  provide  agreement  for  a  particular 
set  of  experimental  results  they  have  poor  predictive  capabilities. 

The  sophistication  of  the  R&R  programs  in  implementing  fracture  mechanics  differs. 
Crack  growth  in  probabilistic  programs  may  be  incorporated  by  the  implementation  of 
one  or  more  stochastic  empirical  crack  growth  equations,  as  described  above.  Some 
programs  allow  a  tabular  input  of  crack  growth  rates  [Grahm  and  Mallinson  1984]  or 


(1) 

(2) 
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have  an  interfacing  crack  growth  model  or  both.  The  computer  program  DARWIN 
includes  a  fracture  mechanics  module  but  may  also  interface  to  a  user-supplied  code 
[Leverant  et  al  1997].  DARWIN  incorporates  a  life  scatter  factor,  which  accounts  for 
material  scatter  and  fracture  mechanics  modelling  errors.  The  life  computed  from  the 
crack  growth  model  is  multiplied  by  the  scatter  factor,  which  is  a  random  factor 
lognormally  distributed,  producing  a  stochastic  life  prediction  [Millwater  et  al  1999]. 

The  fatigue  crack  growth  data  for  specific  alloys  may  be  included  in  the  codes' 
databases.  The  computer  programs  CARES/Life  [Powers  et  al  1992]  and  DARWIN 
[McClung  et  al  1998]  include  crack  growth  data  at  several  temperature  levels  to  include 
the  temperature  effect  on  engine  components.  The  latter  program  also  allows  a  choice 
between  crack  growth  data  at  air  or  vacuum  environments  [Millwater  et  al  1999]. 

For  aging  aircraft,  the  environmental  effect  of  corrosion  reduces  the  structural  life  by 
increasing  the  rate  of  crack  growth.  Orisamolu  and  Luo  (1997)  state  that 
environmental  effects  on  aging  aircraft  should  be  included  in  crack  initiation  and  crack 
propagation  models  incorporated  in  the  reliability  analysis.  They  describe  a 
modification  of  the  power  and  Paris  laws,  incorporating  the  coefficient  for  corrosion  in 
order  to  determine  the  reliability  of  an  aging  aircraft  structure  in  a  corrosive 
environment.  The  probability  of  failure  was  determined  against  the  coefficient  of 
corrosion,  showing  a  rapid  decrease  in  survival  as  corrosion  increased. 


3.1.2  Probabilistic  initiation  life 


The  crack  initiation  phase  accounts  for  the  majority  of  scatter  in  fatigue  life  [Tryon  and 
Cruse  1997].  In  contrast  to  crack-propagation,  the  probabilistic  prediction  of  crack 
initiation  is  limited  to  simple  tesing  cases  of  constant  amplitude  loading.  Clearly, 
advancements  in  understanding  crack  nucleation  and  small  crack  growth  are  necessary 
in  order  to  develop  probabilistic  models  for  crack  initiation. 

One  example  of  application  of  probabilistic  methods  in  crack  nucleation  is  that  of 
Tryon  and  Cruse  (1997).  The  scatter  inherent  in  the  early  stages  of  fatigue  life  was 
investigated  using  mesomechanics,  the  theory  relating  the  microstructural 
heterogeneity  to  the  scatter  in  crack  nucleation  life.  The  Tanaka  and  Mura  model  used 
describes  the  number  of  cycles  to  crack  nucleation  Nn  (Equation  3)  as 


N„=f 


(At  -2k)2  d 


(3) 


where  Ax  is  the  resolved  shear  stress,  k  is  the  shear  strength  needed  to  be  overcome  for 
dislocation  motion,  and  d  is  the  grain  diameter. 

The  grain  size,  local  resolved  shear  stress  and  mean  frictional  strength  are  treated  as 
random  variables.  The  reliability  of  crack  nucleation  life  was  determined  using  a 
specified  number  of  cycles  as  the  probability  of  failure  criterion.  The  shape  of  the  crack 
nucleation  life  distribution  compared  well  with  that  from  limited  experimental  data. 


9 


DSTO-TR-1306 


This  provides  an  example  of  how  probabilistic  mesomechanical  material  models  can 
link  the  uncertainties  in  material  microstructure  to  the  scatter  in  fatigue  life. 

Xiaoming  et.  al,  (1998),  developed  a  reliability  analysis  method  for  fatigue  crack- 
initiation  and  crack  propagation  lives  of  structural  components  subject  to  variable 
amplitude  loading.  The  method  used  an  extension  of  the  local  strain-life  approach  and 
rainflow  cycle  counting  of  damage  parameters  to  predict  multi-axial  crack  initiation 
life.  The  method  correlates  the  known  local  elastic -plastic  strain  state  to  crack  initiation 
life  [Xiaoming  et  al  1998]. 

Cruse,  Mahadevan  and  Tryon  (1997)  describe  a  probabilistic  risk  assessment  (PRA) 
program  for  in-service  Retirement  For  Cause  adopted  by  FAA  for  gas  turbine  engine 
disks.  The  method  has  successfully  implemented  damage  tolerance  approaches  to 
commercial  engines  and  is  continuously  evolving  to  account  for  advancements  in  the 
area.  PRA  includes  probabilistic  models  of  crack  initiation  and  crack  propagation  and 
Probability  of  Detection  (POD)  analysis.  Two  methods  of  probabilistic  analysis  of 
fatigue  life  were  available  for  PRA.  The  first  used  Weibull  and  lognormal  distributions 
to  describe  scatter  in  fatigue  life. 

The  second  approach,  which  according  to  the  authors  is  becoming  the  most  popular 
one,  is  the  use  of  fracture  mechanics  as  the  empirical  form  of  the  life  model.  This 
model  uses  a  single  crack  size  described  as  an  equivalent  initial  flaw  size  to  describe 
crack  initiation.  Initial  results  of  the  PRA  application  to  gas  turbine  engine  disks 
proved  the  fracture  mechanics  model  to  be  non-conservative,  as  a  consequence  of 
multi-site  cracking  in  the  disks.  Consequently  the  PRA  model  was  revised  to 
incorporate  some  of  the  multi-site  damage  effects  [Cruse  et  al  1997]. 

A  group  of  researchers  developing  a  probabilistic  design  life  code  for  turbine  rotors  is 
conducting  tests  to  determine  the  time  to  crack  initiation  in  samples  of  rotor  grade  Ti-6- 
4  material  with  hard  alpha  defects  [Leverant  et  al  1997],  Initiation  life  models  will  be 
developed  as  a  function  of  important  defect  characteristics  and  implemented  in  the 
probabilistic  design  life  model.  This  will  require  an  appreciation  of  the  fundamental 
mechanism  of  crack  initiation  in  the  presence  of  hard  alpha  defects. 


3.2  Computational  Methods 

The  basic  computation  in  determining  the  probability  of  failure,  is  the  multiple  integral 
of  the  probability  density  function  in  the  region  of  failure  (equation  4)  [Moore  et  al 
1990,  Cruse  et  al  1997,  Robinson  1998,  Szekely  1998,  Wu  and  Chen  1999]. 

Pf  =\D\f(xv..xn)dxv..dxn  (4) 

where  Z)  =  {(xl..xn):g(xl..x,l)<0}  is  the  region  of  failure,  Pf  is  the  probability  of 

failure,  f(xi . xn)  is  the  joint  probability  density  function  of  the  drivers  xi,...xn,  and  the 

function  g  is  the  limit  state  which  is  the  boundary  between  region  of  safety  and  region 
of  failure.  The  drivers  for  fatigue  failure  may  be  the  component  strength  and  the 
applied  load  or  the  actual  flaw  size  and  the  critical  crack  size  [Alawi  1990]  or  the 
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operating  time  and  fatigue  life.  The  numerical  evaluation  of  the  above  integral  is 
difficult  and  time  consuming  and  limited  to  simple  cases. 

A  number  of  computational  methods  are  used  to  carry  out  the  probability 
computations  required  in  risk  or  failure  analysis  including  Monte  Carlo  simulation, 
First  and  Second  Order  Reliability  Methods  (FORM/SORM),  Mean  Value  First  Order 
(MVFO)  and  Response  Surface  Method  (RSM).  These  employ  either  random  sampling 
or  analytical  techniques.  A  comprehensive  description  of  the  methods  is  beyond  the 
scope  of  this  review;  an  excellent  reference  identifying  strengths  and  weakness  of  each 
analytical  method  can  be  found  in  [Robinson  1988]. 

According  to  Cruse,  Mahadevan  and  Tryon,  (1997),  limit  state  modelling  approaches 
are  gaining  ground  in  estimating  aircraft  engine  component  and  system  reliability  over 
traditional  methods.  The  most  significant  contribution  of  limit  state  modelling  is  the 
computation  of  the  sensitivities  of  the  structural  reliability  to  the  basic  random 
parameters. 

Monte  Carlo  simulation  has  been  adopted  in  probabilistic  analysis  because  it  can  be 
used  with  failure  modes  of  any  complexity  and  can  give  high  accuracy.  It  is  a  method 
used  in  many  of  the  programs  for  aircraft  and  aerospace  risk  assessment  [Ohnabe  et  al 
1985,  Leverant  et  al  1997].  The  drawbacks  to  this  approach  are  high  computational 
time  and  the  dependence  of  the  statistical  certainty  of  the  estimates  on  the  size  of  the 
sample  [Szekely  et  al  1998,  Xiaoming  et  al  1998]. 

The  computational  effort  associated  with  Monte  Carlo  simulation  can  be  reduced  by 
limiting  the  number  of  simulation  trials  when  the  probability  of  failure  is  extremely 
low  [Moore  et  al  1990].  The  number  of  simulations  normally  necessary  for  accuracy  of 
component  reliability  is  in  the  order  of  10*  to  10*  [Moore  et  al  1990,  Lust  and  Wu  1998, 
Wu  et  al  2000].  A  hybrid  Monte  Carlo  method  that  is  gaining  interest  is  the  Importance 
Sampling  Method.  This  method  increases  computational  efficiency  because  it  samples 
random  variable  realisations  in  the  failure  region  [SRI  1999,  Wu  et  al  2000]. 

First  and  Second  Order  Reliability  Methods  (FORM/SORM)  can  transform  the  integral 
of  equation  4  to  an  approximately  equivalent  one  that  can  be  efficiently  evaluated.  A 
description  of  the  transformation  process  can  be  found  in  references  [Moore  et  al  1990, 
Cruse  et  al  1997,  Robinson  1998,  Xiaoming  et  al  1998].  The  transformation  changes  the 
complex  integration  problem  into  a  mathematical  optimisation  problem,  where  the 
limit  state  function  is  approximated  by  a  simply  defined  surface,  linear  (FORM)  or 
quadratic  (SORM).  The  Mean  Value  First  Order  methods  (MVFO)  use  a  linear 
approximation  for  the  g  function  by  expanding  the  limit  state  function  about  the  mean 
value  of  the  basic  variables,  thus  not  requiring  formal  optimisation  as  FORM/SORM. 
The  critical  step  in  these  methods  is  the  'most  probable  point'  search,  for  which  many 
methods  have  been  developed  [Xiaoming  et  al  1998]. 

There  are  conflicting  views  on  the  efficiency  of  the  computational  methods.  The 
FORM/SORM  approach  has  not  been  considered  appropriate  for  calculating 
probability  of  failure  because  for  complex  non-analytical  limit  state  functions  the 
problem  becomes  unstable  [Moore  et  al  1990].  Monte  Carlo  simulation  is  preferred  to 
FORM/SORM  and  MVFO  methods  due  to  higher  accuracy  of  results  [Moore  et  al 
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1990].  Other  researchers  describe  FORM  and  SORM  as  much  more  efficient  than 
Monte  Carlo  and  reasonably  accurate  [Xiaoming  et  al  1998],  One  source  states 
agreement  between  Monte  Carlo  and  Advanced  Mean  Value  algorithm  results  when 
used  to  evaluate  an  explicit  function  [Lust  and  Wu  1998]. 

Szetely  et  al  (1998)  describe  the  use  of  the  Response  Surface  Method  (RSM)  to  fit  an 
interpolation  function  through  points  of  the  limit  state  function  of  a  complex  structure, 
when  the  explicit  function  cannot  be  derived.  The  drawback  is  in  not  being  able  to 
quantify  the  error  without  knowing  the  real  limit  state  function.  The  authors  state  that 
the  computational  effort  can  reach  that  for  Monte  Carlo  simulations  for  a  large  number 
of  random  variables.  As  a  result,  this  method  is  considered  a  promising  tool  for 
reliability  analysis  only  when  a  limited  number  of  random  variables  are  present. 

From  the  above  it  is  shown  that  the  computational  methods  used  for  determining  the 
probability  of  failure  differ  in  efficiency  and  the  level  of  complexity.  The  Structural 
Safety  and  Reliability  8th  International  Conference  in  2001,  included  a  great  number  of 
papers  on  improved  computational  methods,  with  Monte  Carlo  and  the  Response 
Surface  type  methods  receiving  greater  attention.  It  can  be  said  that  improvements  in 
computational  efficiency  will  be  continuous,  providing  many  options  for  future 
applications  of  probabilistic  methods. 


4.  Data  Requirements 

4.1  Fatigue  Life  of  Components 

Fatigue  crack  growth  data  available  in  company  databases  or  in  the  public  domain 
show  considerable  scatter,  which  may  introduce  uncertainty  in  the  component  life 
prediction  [Ohnabe  et  al  1985,  Provan  1987,  Min  and  Xiong  1992,  AIARI  Sub- 
Committee  1997,  Tryon  and  Cruse  1997],  Fatigue  life  is  affected  by  many  parameters, 
not  always  measurable,  such  as  thermal  and  residual  stresses  and  environmental 
effects. 

According  to  Melis  &  Zaretsky  (1999),  the  effect  of  temperature  gradients  in  a  gas 
turbine  engine  disk  is  two-fold:  - 

(i)  Fatigue  life  of  material  generally  decreases  with  increasing  temperature,  and 

(ii)  Thermal  gradients  in  the  disk  induce  thermal  stresses. 

A  mathematical  expression  is  provided  showing  the  thermal  effect  on  disk  relative  life 
(equation  5),  where  AT  is  total  radial  temperature  difference  and  Kt  is  a  constant.  If  the 
thermal  gradient  is  known  the  equation  can  be  used  to  adjust  the  life  prediction  up  or 
down.  The  authors  note  that  besides  the  thermal  gradients,  the  bulk  temperature  can 
affect  fatigue  life,  but  they  admit  there  is  lack  of  fatigue  data  showing  the  effect  of 
elevated  temperature. 
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Some  fatigue  crack  growth  programs  include  temperature  interpolation  of  fatigue 
crack  growth  properties  or  the  selection  of  properties  at  the  nearest  or  next  highest 
temperature  in  the  database  [Wu  et  al  2000]. 

It  is  similarly  difficult  to  obtain  information  on  compressive  residual  stresses  present  in 
disk  material  from  heat  treatment  or  shot  peening.  Compressive  shear  stresses  can 
reduce  effective  shear  stresses  and  thus  increase  life  [Melis  and  Zaretsky  1999]. 

For  aging  aircraft,  environmental  effects,  such  as  corrosion,  can  significantly  reduce  the 
life  by  increasing  the  crack  growth  rate  of  structures  [Orisamolu  and  Luo  1997,  Whaley 
1998],  This  was  demonstrated  by  Orisamolu  and  Luo  (1997)  for  airframe  components 
in  a  study  that  showed  corrosion  to  significantly  reduce  reliability  levels  [Orisamolu 
and  Luo  1997].  The  effect  of  corrosion  on  engine  component  reliability  was  not 
available  in  the  literature  reviewed. 

G.  Leverant  et.  al ,  (1997),  discuss  the  effect  the  environment  has  on  crack  growth  for 
titanium  alloys,  resulting  in  different  crack  growth  rates  for  surface  fatigue  cracks  and 
embedded  cracks  in  the  same  material.  This  questions  the  relevance  of  fatigue  life  data 
obtained  in  air  or  vacuum  testing  conditions.  The  authors  are  conducting  tests  for 
titanium  engine  alloys  in  vacuum  to  complement  the  databases  of  data  in  air 
environments.  The  vacuum  fatigue  crack  growth  data  is  necessary  for  the  risk 
assessment  of  components  with  sub-surface  defects  that  effectively  grow  in  a  vacuum 
environment  [McClung  et  al  1999]. 

An  additional  effect  on  the  life  of  high-energy  titanium  engine  rotors  is  that  due  to 
inherent  material  anomalies  or  induced  during  manufacturing  or  maintenance.  Thus 
entering  service  and  affecting  the  life  of  engine  components.  The  presence  of  material 
anomalies  in  the  microstructure  of  engine  components  necessitates  the  use  of 
probabilistic  methods  to  describe  the  stochastic  nature  of  the  effect  [AIARI  Sub- 
Committee  1997].  An  FAA  program  is  investigating  the  risk  of  failure  from  melt- 
related  anomalies  called  hard  alpha.  These  anomalies  are  hard  brittle  zones  that  have 
voids  and  cracks  and  are  associated  with  low-cycle  fatigue  cracks  that  have  lead  to 
turbine  disk  failures.  The  quality  of  the  component  material  prior  to  service  is  not 
perfect  but  characterised  by  flaws  that  influence  the  life  of  the  component  and  must  be 
accounted  for  in  the  R&R  code. 

The  uncertainty  in  material  behaviour  that  results  from  microstructural  non-uniformity 
and  material  property  degradation  from  loading  has  been  quantified  in  a  probabilistic 
model,  the  Multi-Factor  Interaction  Equation  (MFIE)  [Shah  et  al  1992,  Jeremic  and 
Bengin  1998].  The  model  assumes  that  material  behaviour  can  be  simulated  by  a 
number  of  primitive  variables  and  describes  how  the  material  property  Mp  is  degraded 
as  the  number  of  cycles  increases  (equation  6).  The  change  in  material  property  is 
expressed  by  the  product  of  any  number  of  effects.  Each  primitive  variable  V  and 
exponent  a,  can  be  random  and  experimental  data  with  engineering  judgement  are 
needed  to  determine  them. 
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where  subscripts  o,f  refer  to  the  condition  at  reference  stage  and  final  stage 

respectively.  Examples  of  use  of  this  model  in  R&R  programs  are  given  in  [Jeremic  and 
Shah  et  al  1992,  Bengin  1998], 

As  well  as  the  processing  and  environmental  effects,  post-production  treatment  of 
engine  components  can  alter  their  fatigue  behaviour.  The  fatigue  life  of  gas  turbine 
engine  components  can  be  significantly  affected  by  machining  operations,  where 
inappropriate  or  abusive  machining  can  increase  crack  growth  rate  and  reduce  the 
useful  life  [Cruse  et  al  1997,  Tong  and  Kappas  2002], 

As  Cole  (1998)  points  out,  the  accuracy  of  computations  arising  from  the  limiting 
assumptions  in  the  reliability  models  should  not  hamper  their  use.  He  believes  that 
models  should  be  made  as  realistic  as  possible  and  should  be  calibrated  against 
experience.  He  continues  stating  the  difficulties  associated  with  service  data  gathering: 

•  The  process  requires  long-term  commitment, 

•  Lack  of  precise  definition  of  quantity  to  be  measured, 

•  Existing  data  is  censored, 

•  The  critical  component  may  not  be  detected, 

•  Cost  may  not  be  the  driving  force. 


4.2  Availability  of  Data 


"Risk  estimates  are  commensurate  with  the  amount  of  information  input  to  the  failure  or 
probabilistic  model"  [Moore  et  al  1990]. 

General  agreement  exists  among  researchers  as  to  the  limitations  in  quality  and  volume 
of  experimental  data  available  to  support  reliability  analysis  of  aircraft  engines.  Data  is 
required  as  input  to  the  probabilistic  models  and  also  for  validation  of  the  results. 

For  gas  turbine  disks,  spin  pit  testing  provides  the  means  of  determining  crack  growth 
characteristics  and  the  life  of  engine  components.  The  importance  of  spin  pit  testing  of 
gas  turbine  engine  disks  is  discussed  in  [Mahorter  et  al  1985b]  and  its  use  in 
probabilistic  analysis  has  been  described  in  [Ohnabe  et  al  1985,  Melis  and  Zaretskv 
1999], 

The  lack  of  fatigue  crack  growth  rate  data  for  titanium  alloys  in  a  vacuum  and  the 
effect  of  temperature  and  stress  ratio  on  the  fatigue  crack  growth  rates  are  discussed  in 
[McClung  et  al  1998],  This  data  was  necessary  to  develop  a  probabilistic  damage 
tolerance  method  for  turbine  rotors  that  are  characterised  by  sub-surface  hard  alpha 
inclusions.  Due  to  the  lack  of  data,  the  researchers  have  conducted  their  own 
experiments  on  titanium  alloys  for  fatigue  crack  growth  in  vacuum  at  different 
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temperature  and  stress  ratios  and  have  made  the  data  available  to  the  public  [McClung 
et  al  1998]. 

Besides  the  material  and  crack  propagation  characteristics  of  engine  components,  the 
stresses  or  operational  loading  is  required  and  may  be  obtained  from  the  mission 
and/or  finite  element  analysis.  The  importance  of  using  updated  mission  profiles  to 
accurately  determine  the  engine  operating  stresses  has  been  much  emphasised  [Tong 
and  Kappas  2002].  Le  and  Peterson  (1999)  describe  how  fatigue  reliability  assessment 
of  in-service  engine  components  can  be  achieved  when  no  loading  information  exists. 
Fatigue  testing  of  components  removed  from  service  provided  the  additional  data 
necessary  in  terms  of  the  damage  accumulation  over  a  period  of  time.  The  method 
compares  the  fatigue  damage  resistance  of  tested  and  new  components  to  indirectly 
obtain  the  fatigue  damage  accumulation  due  to  cyclic  loading  of  in-service 
components.  This  data  can  be  used  to  calculate  the  fatigue  life  of  in-service 
components  for  a  specified  reliability  level.  The  model  has  been  used  on  compressor 
disks  by  conducting  fatigue  testing  of  a  large  number  of  retired  disks.  The  limitation  of 
this  method  lies  in  the  availability  of  enough  retired  components. 

A  common  feature  of  probabilistic  fracture  mechanics  is  the  introduction  of  stochastic 
exponents  in  crack  growth  rate  equations.  This  approach  has  been  used  to  incorporate 
material  variability  in  the  Paris-Erdogan  and  Forman  equations  [Min  and  Xiong  1992, 
Xiaoming  et  al  1998].  Obtaining  the  experimental  data  to  describe  statistically  the 
stochastic  nature  of  the  exponents  is  a  difficult  task.  Wu  and  Chen  (1999)  proposed  a 
systematic  approach  to  determining  density  distribution  functions  for  the  input 
parameters  when  data  is  limited.  They  recommend  the  use  of  a  spectrum  of  candidate 
distribution  models  to  provide  a  range  of  reliability.  The  range  of  values  can  assist  in 
building  confidence  in  the  reliability  result,  as  many  input  assumptions  have  been 
covered. 

Round  robin  studies  are  an  excellent  source  of  material  and  crack  growth  databases  for 
use  in  R&R  programs  and  at  the  same  time  rare  due  to  costs.  One  such  recent  study  is 
that  of  AGARD  on  Ti-6-4  forgings,  which  involved  replicate  tests  at  13  laboratories  and 
allowed  the  scatter  in  the  experimental  life  to  be  assessed  [McClung  1999].  Other 
programs  at  developing  databases  exist  within  engine  OEM's  but  as  was  made  clear  in 
the  PMC2001  conference,  the  data  collected  for  example  by  United  Technologies  on  a 
program  on  turbine  blade  thickness  variability  would  not  be  provided  to  the  public 
[Orisamolu  and  Luo  1997], 


4.2.1  Benchmarking  and  comparing  with  statistical  databases 

Melis  and  Zaretsky  (1999)  state  that  the  validation  of  any  R&R  model  for  engine 
components  is  difficult  due  to  the  limited  amount  of  fatigue  data.  The  limited  amount 
of  experimental  data  for  use  in  probabilistic  programs  has  been  linked  to  the  expense 
of  full  scale  testing,  the  extensive  time  requirements  and  the  difficulty  in  simulating  all 
possible  loading  conditions  [AIARI  Sub-Committee  1997]. 
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Majorter  et  al  (1985)  used  low-cycle  fatigue  testing  data  for  gas  turbine  compressor 
disks  of  titanium  alloy  (Ti-6A1-4V)  generated  at  the  Naval  Air  Development  and  the 
Naval  Air  Propulsion  Centers,  to  compare  with  analytical  life  predictions  made  by  the 
manufacturer.  Five  disks,  each  of  two  different  types  were  LCF  tested  until  a  crack  at 
the  bolthole  exceeded  the  1/32"  limit.  Weibull  analysis  of  results  allowed  the  Weibull 
shape  parameter  and  the  corresponding  life  at  one  in  a  thousand  failure  to  be 
predicted.  The  comparison  of  experimental  and  manufacturers  analytical  lives 
indicated  that  the  analytical  predictions  were  not  consistently  conservative. 

Majorter  et  al  (1985)  discuss  the  issue  of  sample  size  for  component  testing  and 
confidence  levels  of  predictions  stating  that  large  sample  sizes  are  not  practically 
possible  due  to  expense  of  spin  pit  testing.  They  discuss  the  loss  of  accuracy,  due  to 
the  small  sample  size  of  five  disks,  as  being  a  20%  error  in  the  observed  Weibull  slope. 
Their  analysis  of  the  results  at  an  80%  confidence  level  for  various  sample  sizes  shows 
a  large  variation  in  one  in  a  thousand  life  predictions  for  the  disks,  due  to  the 
experimental  scatter  in  values  rather  than  the  small  sample  size.  The  Weibull  slope 
obtained  (2.8-3.5)  corresponded  to  a  value  between  that  obtained  from  materials  test 
specimens  and  that  from  in-service  parts  performance.  The  results  of  the  spin  pit 
testing  did  not  prove,  as  the  authors  expected,  that  the  manufacturer's  analytical 
predictions  were  conservative.  On  the  contrary,  the  authors  question  whether  engine 
components  may  be  in  operation  beyond  their  one  in  a  thousand  lives.  Based  on  their 
results,  where  they  had  difficulty  in  establishing  the  one  in  a  thousand  life,  the  authors 
recommend  the  use  of  a  Retirement  for  Cause  approach  for  gas  turbine  engine  disks 
life  management. 

Melis  and  Zaretsky  (1999)  used  the  same  LCF  database  to  benchmark  the  predictions  of 
the  Probable  Cause  program.  They  state  that  the  LCF  data  resulting  from  spin  rig 
testing  of  disks  was  the  only  such  failure  data  available  in  the  open  literature.  They 
further  comment  that  relevant  data,  including  material  processing  and  metallurgical 
characteristics  of  the  titanium  alloy,  manufacturing  process  and  engine  operating 
temperature  of  each  disk,  were  not  available.  As  the  authors  mention,  the  unreported 
variables  can  affect  the  disk  life  and  the  results  of  statistical  life  analysis. 

The  obvious  difficulty  in  validating  life  predictions  shows  how  validation  of  R&R 
programs  for  engine  components  is  also  hindered. 

4.3  Stochastic  Drivers 

According  to  Berens  (1996)  although  there  are  many  stochastic  elements  influencing 
the  initiation  and  growth  of  cracks,  most  damage  tolerance  applications  still  use  a 
deterministic  approach.  Moore,  Ebbeler  and  Creager  (1990)  state  that  inputs  to  failure 
models  described  by  intrinsic  variability  and  specification  error  should  be  represented 
stochastically.  They  mention  material  properties  and  input  loads  as  examples  of 
intrinsic  variation.  They  also  describe  specification  error  as  originating  from  the 
accuracy  of  the  engineering  model  and  the  limited  or  incomplete  information 
regarding  the  physical  parameters  describing  the  failure  process. 
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Many  researchers  treat  the  stochastic  drivers  as  random  variables  of  specified 
distributions.  Cruse,  Mahadevan  and  Tryon  (1997)  state  that  the  random  variables 
describing  a  reliability  model  should  be  physically  measurable  to  determine  the  scatter. 
When  a  high  number  of  potential  random  variables  exist,  the  authors  suggest 
performing  sensitivity  analysis  to  determine  the  significant  random  variables  by 
response  of  the  system.  This  method  was  used  for  a  gas  turbine  engine  system  where 
the  eleven  initial  significant  random  variables  were  reduced  to  five,  by  perturbation  of 
the  random  variables  in  each  of  heat  transfer,  stress  analysis  and  crack  propagation 
models.  The  Paris  law  representation  was  then  used  to  determine  a  performance 
function  that  more  closely  fitted  the  results  of  the  fatigue  life  perturbation  analysis. 


4.3.1  Probability  density  distribution  functions 

Historically  a  probabilistic  approach  to  determining  lives  of  engine  components  was 
suggested  by  Palmgren  in  1924  for  rolling-  element  bearings  and  Weibull  in  1939  for 
the  scatter  in  material  strength  of  solids.  Weibull  analysis  has  consequently  been  used 
to  describe  life  of  engine  components. 

Cole  (1998)  states  that  the  Weibull  distribution  "has  been  the  most  useful  one  for  analysing 
aero-engine  failures",  because  it  can  handle  all  three  parts  of  the  bathtub  curve.  The 
Weibull  slope  |3,  describes  infant  mortality  (P<1),  random  (p=l)  and  wear-out  (P>1) 
sections  of  the  bathtub  curve.  The  author  refers  to  the  work  by  Dr  R.  Abemethy  of 
Pratt  &Whitney  in  early  1970s  that  lead  to  the  development  of  the  'benchmark'  working 
manual  on  Weibull  analysis  for  jet  engines.  The  manual  includes  techniques  that  deal 
with  the  censored  nature  of  the  failure  data  encountered  in  military  applications. 

It  is  often  found  in  the  literature  that  certain  distribution  functions  are  commonly  used 
among  researchers  to  describe  variation  in  material  properties.  According  to  Provan 
(1987),  a  number  of  distributions  can  empirically  describe  the  scatter  in  fatigue  data, 
including  exponential,  lognormal,  Weibull  and  Gumbell  (extreme  value).  The  author 
states  that  often  the  exponential  distribution  may  be  chosen  as  a  failure  model  because 
it  is  easy  to  use  rather  than  because  of  understanding  the  physical  damage  occurring  in 
a  heterogeneous  material. 

The  Weibull  and  lognormal  distributions  have  both  been  used  to  describe  scatter  in 
crack  initiation  life  [Ohnabe  et  al  1985,  Cruse  et  al  1997].  The  mean  value  and  standard 
deviation  of  the  lognormal  distribution  for  the  time  to  crack  initiation  can  be  obtained 
from  component  testing  and  coupon  testing  respectively  [Ohnabe  et  al  1985].  Weibull 
has  been  used  to  describe  fatigue  life  [Mallinson  1982]  and  initial  crack  size  for  gas 
turbine  engine  disks  [Cruse  et  al  1997].  Lognormal  has  been  applied  to  describe 
variation  in  critical  crack  size  [Ohnabe  et  al  1985]  and  the  scatter  in  the  stress  and  life 
predictions  for  gas  turbine  disks  [Millwater  and  Wu  1992]. 

It  is  important  though  to  ask  whether  the  correct  type  of  distribution  function  is  used 
or  previous  choices  simply  followed.  It  has  been  stated  that  the  probability  of  failure, 
Pf,  is  very  sensitive  to  the  choice  of  the  type  of  input  density  functions  used  to  describe 
the  life  or  material  properties  [Wu  and  Chen  1999,  Tong  and  Kappas  2001].  According 
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to  Wu  and  Chen  (1999),  a  drawback  of  probabilistic  modelling  is  the  need  to  accurately 
describe  distributions  for  the  input  parameters.  They  state  that  the  uncertainties  from 
the  models  are  minor  compared  to  those  from  the  input  parameters,  a  fact  which 
discourages  some  researchers  away  from  the  application  of  reliability  models  towards 
the  use  of  the  safety  factor. 

The  choice  of  distribution  functions  has  to  be  justified.  A  systematic  approach  to 
developing  distribution  functions  for  input  parameters  to  reliability  models  when  data 
is  limited  has  been  proposed  by  Wu  and  Chen  (1999).  The  authors  suggest  reliability 
analysis  be  performed  for  a  number  of  potential  distribution  functions  describing  the 
input  random  variables.  A  sensitivity  analysis  on  the  results  will  then  identify  the 
significant  random  variables  to  which  confidence  limits  can  be  assigned  and  reliability 
bounds  can  be  determined.  The  authors  also  discuss  the  significant  effect  of  outliers 
(odd  data  points)  on  the  distribution  function  describing  the  random  variable,  list 
methods  for  testing  for  outliers  and  state  that  the  existence  of  outliers  depends  on  the 
distribution  assumptions.  As  stated  in  the  conclusion  of  the  reference,  using  a 
spectrum  of  distributions  produces  a  range  for  reliability  adding  credibility  to  the 
reliability  analysis  result.  The  approach  described  by  Wu  and  Chen  (1999)  was 
independently  undertaken  in  the  reliability  study  conducted  in  DSTO  on  engine 
turbine  disks.  The  sensitivity  analysis  identified  the  significant  input  parameters  for 
each  of  two  of  fan  disk  cracking  incidents  [Tong  and  Kappas  2001], 

According  to  Moore,  Ebbeler  and  Creager  (1990),  engineering  analysis  and  past 
experience  can  be  used  to  characterise  the  probability  distribution  functions  when  no 
extensive  experimental  measurements  exist.  In  the  case  of  limited  information 
available,  they  state  the  importance  of  never  overstating  its  significance.  The  following 
general  guidelines  for  characterising  stochastic  drivers  are  provided: 

1 .  Include  all  sources  of  driver  uncertainty, 

2.  Driver  information  used  should  be  traceable  and  documented, 

3.  The  driver  information  should  include  available  data,  past  experience  and 
engineering  analysis, 

4.  For  physically  bound  drivers,  the  beta  distribution  has  been  used, 

5.  For  drivers  with  scalar  information  only,  the  uniform  distribution  has  been  used, 

6.  Past  experience  assists  in  characterising  drivers  using  particular  distributions. 

Often  the  lack  of  data  hampers  the  accurate  description  of  variability.  One  study 
describes  how  the  mean  and  standard  deviation  of  the  critical  crack  size  were 
determined  from  the  values  for  mean  and  standard  deviation  of  the  fracture  toughness 
[Whaley  1998].  Researchers  using  finite  element  analysis  in  combination  with  Weibull 
representation  of  material  properties  to  determine  the  probability  of  survival  of  the 
turbine  disk,  comment  that  in  the  absence  of  known  Weibull  parameters  it  may  be 
permissible  to  assume  them  [August  and  Zaretsky  1993], 

Expert  opinion  can  be  utilised  to  describe  the  distribution  of  engine  component  life 
data,  in  the  presence  of  limited  experimental  data  using  a  PC-interactive  approach 
[Singpurwalla  1988].  The  underlying  assumption  in  this  approach  is  that  the  life  data 
can  be  described  by  a  Weibull  distribution.  Expert  opinion  is  required  to  provide  the 
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shape  factor  of  the  distribution  and  the  median  value  and  variability  for  the  life.  The 
paper  describes  two  real  life  applications,  one  of  sufficient  life  data  and  one  of  scarce 
life  data.  In  the  latter  case  failure  data  from  spin-pit  testing  of  five  gas-turbine  engine 
disks  were  complemented  by  expert  opinion  from  OEM  and  the  analyst  to  obtain  a 
representative  Weibull  distribution  of  the  life  of  the  disk.  The  OEM  expertise  was  used 
to  deduce  the  median  life  and  the  variability  for  the  disk.  Comparison  was  made 
between  the  results  of  this  approach  with  the  analytical  OEM  lives.  One  important 
conclusion  from  the  results  was  that  the  analytical  OEM  lives  were  inconsistently 
conservative.  One  may  question  the  effect  of  subjective  opinion  of  expert  and  analyst 
in  this  approach  and  emphasise  the  importance  of  understanding  the  nature  of  the 
failure  mode  prior  to  assigning  a  distribution  function  to  limited  data. 

The  variation  in  fracture  toughness  is  required  as  input  to  many  probabilistic  models  of 
fracture  as  representative  of  the  variation  in  residual  strength,  or  critical  crack  size 
[Graham  and  Mallinson  1984,  UK  DEFSTAN  00-971  1987,  Whaley  1998].  The  necessity 
of  conducting  experiments  in  order  to  justify  the  distribution  chosen  to  represent 
fracture  toughness  of  material,  initial  crack  size,  critical  crack  length  is  obvious.  This 
need  is  crucial  for  obtaining  crack  information  for  aging  structures  suffering  from 
corrosion.  As  Whaley  (1998)  states,  the  identification  of  the  distribution  describing  the 
initial  crack  size  for  corroded  material  is  a  critical  task,  hampered  by  even  less  data 
than  for  non-corroded  material.  The  author  further  states  the  need  for  experimental 
work  to  determine  crack  growth  rate  and  fracture  toughness  of  corroded  material  from 
aging  aircraft  structures.  This  may  equally  apply  to  engine  alloys  affected  by 
corrosion. 

According  to  Duffy,  Powers  and  Starlinger  (1993),  the  use  of  the  three-parameter 
Weibull  distribution  has  been  limited  due  to  lack  of  strength  data  and  the  difficulty  in 
estimating  the  parameters.  The  authors  propose  a  threshold  stress  to  be  used  as  the 
third  parameter  in  the  Weibull  distribution  such  that  zero  probability  of  failure  exists 
for  applied  stress  at  or  below  the  threshold  value.  The  application  of  the  proposed 
method  to  a  turbo  pump  blade  using  CARES  /Life  computer  program  showed  better 
agreement  with  data  and  proved  the  two-parameter  method  to  be  conservative  at  all 
stress  levels.  Nevertheless,  the  authors  carefully  point  out  that  further  tests  would  be 
necessary  to  conclude  whether  a  population  behaves  according  to  the  two  or  three 
parameter  Weibull  distribution. 

It  is  possible  to  incorporate  test  failure/ success  data  in  the  development  of  a  failure 
probability  distribution  [Moore  et  al  1990,  Moore  et  al  1992b,  Singpurwalla  1988].  A 
statistical  approach  using  Bayes  rule  [Moore  et  al  1990]  has  been  used  to  modify  the 
prior  distribution  of  a  failure  parameter  by  using  success/ failure  data  obtained  from 
test  or  service  experience.  This  Bayesian  approach  allows  a  prior  failure  probability 
distribution  to  be  updated  given  the  additional  test  failure  data.  It  has  been  used  to 
incorporate  success /failure  data  in  the  reliability  analysis  for  launch  vehicle  propulsion 
systems  [Moore  et  al  1990],  and  for  gas-turbine  aircraft  engine  disks  [Singpurwalla 
1988].  It  is  emphasised  that  the  existence  of  success/ failure  data  for  a  component  is  an 
exception  to  most  failure  situations,  as  tests  are  rarely  conducted  to  fail  components. 
This  comment  certainly  applies  to  launch  propulsion  systems,  but  also  for  military 
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engine  disks,  where  spin  pit  tests  can  supply  appropriate  failure/success  data  but  in  a 
limited  amount. 

Inevitably  testing  has  to  be  conducted  to  provide  data  for  determining  the  correct 
distribution  function.  One  program  attempted  to  establish  a  statistically  meaningful 
Weibull  failure  distribution  for  a  limited  number  of  engine  disks  by  cyclic  spin  pit 
testing,  to  determine  the  life  at  one  in  a  thousand  failure  and  compare  this  with  the 
analytical  life  prediction.  Weibull  was  again  chosen  because  it  is  the  most  commonly 
used  distribution  for  aircraft  design  failures.  The  paper  mentions  a  current 
investigation  undertaken  to  determine  the  statistical  distribution  best  suited  for  aircraft 
disk  failures  [Singpurwalla  1988].  Another  study  used  a  combination  of  component 
testing  and  coupon  specimens  to  determine  the  lognormal  distribution,  assumed  to 
best  describe  the  time  to  crack  initiation  of  jet  engine  disks.  The  mean  value  for  the 
time  to  crack  initiation  was  obtained  from  component  test  data  under  nominal  loading 
spectra  and  the  standard  deviation  was  obtained  from  coupon  specimens  and 
statistical  dispersion  of  service  loads  [Ohnabe  et  al  1985].  As  mentioned  at  the 
PMC2001  conference,  developing  databases  to  define  distributions  is  a  current 
requirement  in  the  aircraft  manufacturing  industry,  but  comes  at  a  high  cost  [Rogers 
2001], 

The  AIA  Rotor  Integrity  Sub-Committee  (1997)  which  has  aimed  to  reduce  uncontained 
gas  turbine  rotor  events  had  difficulty  obtaining  the  data  needed  for  the  development 
of  a  hard  alpha  anomaly  distribution  for  engine  risk  assessment.  A  major  difficulty  in 
obtaining  the  data  was  that  the  available  data  corresponded  to  material  samples  with 
different  shapes  and  therefore  different  inspectable  cross-sectional  areas  that  distorted 
the  initial  findings.  An  investigation  of  the  fundamental  mechanism  causing  the 
distribution  of  anomalies  was  necessary.  A  series  of  analytical  models  that  simulated 
the  manufacturing  process,  incorporating  the  observed  data,  was  implemented  to 
modify  the  database  to  that  required  for  the  baseline  distribution.  The  final 
distribution  was  estimated  from  the  adjustment  of  the  baseline  so  that  it  matched  that 
of  commercial  engine  service  experience  over  a  period  of  years. 

Clearly  there  has  been  limited  effort  to  obtain  an  understanding  of  the  fundamental 
mechanisms  that  cause  variability  in  material  properties  and  fatigue  life.  The 
assumption  of  a  distribution  function  type  and  shape  can  produce  inaccurate  results 
and  should  be  avoided.  For  risk  assessment  of  engine  components,  the  choice  of 
probability  density  functions  will  be  a  difficult  procedure  [Tong  and  Kappas  2002]. 


4.4  Current  Technology 

Finite  element  analysis  and  non-destructive  testing  provide  input  to  risk  assessment 
programs.  Any  technological  improvements  in  these  fields  will  reflect  on  the 
development  of  R&R  programs 
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4.4.1  Finite  element  analysis 

Finite  element  methods  are  incorporated  in  a  number  of  reliability  programs  to 
determine  stress  distributions  at  a  critical  location  or  region  [Moore  et  al  1990,  Nemeth 
et  al  1990,  Shah  et  al  1992,  Lust  and  Wu  1998,  Hughes  2000]. 

R&R  programs  that  are  modular  and  have  an  interface  with  a  finite  element  code 
include  CARES/Life  [Rahman  et  al  1998],  NESSUS  [SRI  1999],  SPSLIFE  [Saith  et  al 
1995]  and  DARWIN  [Wu  et  al  2000].  These  go  beyond  the  first  level  of  only 
determining  stresses  and  temperatures  but  also  determine  the  probability  of  survival 
and  the  risk.  Such  programs  determine  the  "risk"  hot  spots  of  an  engine  component. 

August  &  Zaretsky  (1993)  describe  a  method  that  incorporates  finite  element  analysis 
into  component  life  and  reliability  adopting  a  discrete-stressed  volume  approach.  The 
method  uses  shear  stress  results  from  FE  analysis  to  determine  the  life  and  probability 
of  survival  for  each  computed  element.  The  method  has  been  used  in  the  program 
Probable  Cause  where  the  survivability  of  each  stressed  volume  as  well  as  the 
survivability  of  the  whole  component  can  be  determined,  identifying  spots  for 
redesign.  The  method  uses  shear  stress  results  from  FE  analysis  to  determine  the  life 
and  probability  of  survival,  S,  for  each  element  (Section  5.1). 

In  the  DARWIN  program,  the  stress  in  the  component  is  treated  as  a  random  variable 
[Wu  et  al  2000].  The  deterministic  stress  prediction  from  the  finite  element  analysis  is 
subjected  to  a  multiplying  factor  that  is  a  random  variable.  This  random  variable 
accounts  for  limitations  in  FE  predictions  and  variability  in  geometric  tolerances,  which 
affect  the  result  of  the  risk  assessment.  The  stress-multiplying  factor  is  assumed  to 
have  a  lognormal  distribution  [Millwater  and  Wu  1992]. 

Szekely  et  al  (1998)  describes  how  stochastic  modelling  of  a  structure  is  achieved  by 
treating  the  important  parameters  of  a  FE  model  as  random  variables  and  using  Monte 
Carlo  simulation.  Commercial  FE  models  can  be  utilised  in  the  Monte  Carlo 
simulation  without  significant  changes  in  the  internal  structure  of  the  FE  analysis.  The 
process  that  involves  pre-processing,  a  loop  of  FE  rims,  and  post-processing  of  the 
results  has  been  found  time-consuming  and  methods  of  reducing  computational  time 
are  available  [Hughes  2000]. 

The  stochastic  approach  is  the  latest  significant  development  in  commercial  FE 
programs.  Probabilistic  FE  programs  provide  greater  flexibility  as  the  uncertainty  in 
input  parameters  is  incorporated.  ANSYS  and  ProFES  are  two  examples  of  software 
that  determine  component  stress  as  a  result  of  stochastic  inputs.  ANSYS  has  further 
expanded  into  stochastic  crack  growth  analysis  [Khor  2001].  ProFES  allows 
probabilistic  models  to  be  developed  from  existing  deterministic  FE  models  and  was 
developed  initially  for  the  turbine  engine  industry  and  with  industrial  partners 
including  engine  OEMs  (PWA,  GE  and  Rolls-Royce)  [Cesare  and  Sues  1999]. 
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4.4.2  Non  destructive  evaluation 

The  application  of  probabilistic  methods  for  gas  turbine  disks  described  by  Ohnabe  et 
al  (1985)  demonstrated  that  improvement  in  fatigue  reliability  is  sensitive  to  the  crack 
detection  capability  of  the  NDE  technique.  NDE  was  applied  to  turbine  engine  disks  to 
define  the  inspection  procedure  for  Retirement  For  Cause  of  the  disks.  This  was 
conducted  at  two  stages  to  avoid  erroneous  removals.  If  the  disk  passed  the  first 
inspection,  the  disk  was  returned  to  service,  while  if  the  first  inspection  rejected  the 
disk,  a  second  inspection  was  undertaken  before  removing  the  disk  from  service.  The 
industry  is  aware  of  the  limitations  of  the  NDE  methods  and  has  to  assure  there  are  no 
costs  from  unnecessary  component  removals. 

Clearly,  the  NDE  capability  is  extremely  important  in  a  Damage  Tolerance  or 
Retirement  For  Cause  approach.  Cruse,  Mahadevan  and  Tryon  (1997)  state  that  the 
effectiveness  of  crack  detection  through  NDE  lies  in  the  sensitivity  of  the  method  in 
terms  of  nominal  detectable  crack  size  and  the  reliability  of  detection.  The  latter  is 
given  in  terms  of  the  Probability  Of  Detection  (POD)  curves.  As  the  authors  state  "a  key 
reliability  question  for  NDE  measures  is,  what  is  the  largest  crack  that  can  be  missed?"  The 
authors  discuss  that  obtaining  the  true  POD  characteristics  is  the  least  developed  part 
of  a  Retirement  For  Cause/Damage  Tolerance  approach,  further  clouded  by  the 
inaccurate  setting  of  field  inspection  NDE  limits  on  the  basis  of  laboratory  induced 
cracks. 

NDE  capability  has  been  found  inadequate  in  detecting  multi-site  cracking  in  gas 
turbine  engines  [Cruse  et  al  1997]  and  fatigue  cracking  due  to  pitting  corrosion  in  aging 
aircraft  [Harlow  and  Wei  n.d].  Issues  of  accessibility  and  inspectability  are  well 
discussed  in  [Goranson  1997],  Reference  [Harlow  and  Wei  n.d]  describes  the 
difficulties  in  producing  POD  curves  for  corrosion-induced  fatigue  damage  and  the 
need  to  significantly  reduce  the  detectable  size. 

Experience  in  the  gas  turbine  industry  has  demonstrated  that  material  anomalies  may 
not  be  detectable  with  standard  NDE,  degrading  the  engine’s  structural  integrity 
[AIARI  Sub-Committee  1997].  Improvement  in  NDE  capability  would  ensure  defects 
with  potential  catastrophic  consequences  for  fatigue  life  are  detected  earlier  through 
inspection. 

R&R  programs  may  incorporate  the  NDE  capability  in  the  form  of  POD  curves, 
developed  from  experimental  data  for  a  specific  component  structure.  Safie  and  Hage 
(1991)  describe  a  model  that  utilised  data  provided  by  Pratt  and  Whitney  for  engine 
material  to  derive  the  POD.  The  model  describes  the  POD  as  a  function  of  the  length  of 
the  crack  inspected  and  two  crack  growth  parameters.  However  its  application  is 
limited  to  a  population  of  structures  that  have  the  same  material  and  geometrical 
characteristics. 

The  computer  program  DARWIN  allows  multiple  PODs  depending  on  the  geometrical 
locations  of  the  engine  component  and  on  whether  the  inspection  is  made  at  the  start  of 
operation  or  in  the  field  [Leverant  et  al  1997].  This  acknowledges  the  dependency  of 
the  NDE  result  on  the  geometrical  location  of  inspection  and  the  operational 
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procedures.  One  single  POD  cannot  account  for  all  locations,  even  on  the  same 
component.  In  DARWIN  the  POD  curve  is  used  for  post-inspection  definition  of  defect 
distribution  and  thus  has  significant  influence  on  the  risk  assessment. 


5.  Applications 

The  programs  available  for  risk  assessment  of  engine  components  vary  in  terms  of 
probabilistic  methods,  the  number  of  random  variables  incorporated  and  the 
adaptability  and  flexibility  to  many  modes  of  failure.  The  next  generation  of  these 
programs  is  expected  to  adopt  a  modular  structure  that  allows  interfacing  and  is 
expandable  to  incorporate  other  failure  modes  or  stochastic  parameters.  These 
programs  will  inevitably  grow  in  their  capability  in  order  to  be  applicable  to  a  wide 
range  of  engine  components  with  different  failure  mechanisms. 

A  number  of  programs  have  been  developed  specifically  for  R&R  analysis  of  aircraft 
engine  components  (Probable  Cause,  DARWIN,  Probabilistic  Risk  Assessment, 
Cares/ Life).  There  is  a  larger  group  developed  for  application  in  other  propulsion 
systems  such  as  for  aerospace  components  (NESSUS),  as  well  as  programs  for  generic 
use.  The  following  section  reviews  some  of  the  programs  with  engine  applicability  and 
provides  examples  of  applications. 


5.1  Gas  Turbine  Engines 

Design  Assessment  of  Reliability  With  INspection  (DARWIN)  is  a  probabilistic  damage 
tolerance  computer  code  developed  by  Southwest  Research  Institute.  The  program 
was  initiated  by  the  FAA  for  gas  turbine  engine  rotors  following  the  Sioux  City  rotor 
failure  [ALARI  Sub-Committee  1997,  Leverant  et  al  1997,  McClung  et  al  1999].  It  was 
developed  in  collaboration  with  four  major  US  engine  manufacturers,  Honeywell,  Pratt 
&  Whitney,  General  Electric  and  Rollce  Royce-AUison.  The  use  of  the  DARWIN 
program  does  not  replace  the  safe-life  design  methods  but  aims  to  provide  a  tool  for 
engine  manufacturers  for  risk  management.  The  code  focuses  on  low-cycle  fatigue  as  a 
consequence  of  hard  alpha  defects  in  titanium  disks  but  there  are  plans  to  expand  it  to 
include  other  alloys  and  other  low-cycle  fatigue  failure  modes  such  as  those  induced 
by  porosity  or  abusive  machining  (Section  5.3). 

DARWIN  has  finite  element  and  graphical  user  interfaces.  The  fatigue  crack  growth 
module  allows  a  choice  of  crack  growth  models  and  solutions  including  stress  ratio 
and  temperature  effects  and  user-defined  databases  [McClung  1999].  DARWIN  uses 
two  random  variables,  the  Stress  Multiplying  and  Life  Scatter  factors,  to  describe  the 
scatter  in  the  finite  element  predicted  disk  stress  and  crack  growth  predicted  disk  life 
[Millwater  and  Wu  1992].  Thus  the  stress  and  the  life  of  the  disk  are  obtained  as  the 
product  of  predicted  deterministic  values  and  a  random  variable,  (equations  7,  8).  The 
temperature  interpolation  of  alloy  material  properties  is  a  favourable  feature  of 
DARWIN  because  temperature  effects  are  significant  for  gas  turbine  operation.  Monte 
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Carlo  and  Importance  Sampling  Method  simulations  are  implemented  [Leverant  et  al 
1997], 


Stress  =  X ,  *  FE  Predicted  Stress 


(7) 


Life  =  X  2  *  Predicted  Life  (8) 

The  risk  assessment  in  DARWIN  is  conducted  on  a  zone  basis,  each  zone  consisting  of 
elements  with  similar  material  and  stress  characteristics,  but  different  defect 
occurrence  rates.  The  zone-based  approach  allows  the  user  to  concentrate  on  specific 
locations  of  interest,  allowing  faster  analysis.  The  probability  of  failure  of  a  zone.  Pi,  is 
conditional  to  the  presence  of  a  material  anomaly  in  the  zone  and  is  given  by  equation 
9,  where  a*  is  the  rate  of  defect  occurrence  in  the  zone  and  Pf  is  the  probability  of 

fracture  of  the  zone,  with  the  anomaly.  Both  ai  and  Pf  are  obtained  from  a 

distribution  of  material  anomalies  in  the  zone  and  from  fracture  mechanics 
respectively. 


P,  =a,  *P, 


(9) 


The  component  probability  of  failure  is  obtained  from  the  summation  of  the 
probabilities  of  failure  from  each  zone  (Section  6.1)  and  single  defect  occurrence  is 
assumed  for  each  zone.  Future  extensions  include  the  presence  of  multiple  defects  in 
zones  [Wu  et  al  1999], 

References  [Millwater  and  Wu  1992,  Wu  et  al  2000]  provide  examples  of  DARWIN 
applications  to  industry-supplied  models,  showing  comparison  of  computational 
methods  used  for  refining  the  program  capabilities.  The  results  show  the  decline  in 
risk  of  fracture  for  a  population  of  disks  when  inspection  maintenance  is  introduced. 
There  is  an  expected  increase  of  applications  of  DARWIN  in  gas  turbine  engines  as  this 
program  has  received  a  positive  response  from  manufacturers  and  researchers. 
DARWIN  applications  to  aircraft  and  helicopter  components  were  presented  at  the 
2001  Annual  FAA/Air  Force/NASA/Navy  Workshop  on  the  Application  of 
Probabilistic  Methods  (PM)  to  Gas  Turbine  Engines. 

Another  probabilistic  computer  code  is  Probable  Cause,  described  by  Melis  and 
Zaretsky  (1999),  based  on  the  computational  method  of  August  and  Zaretsky  (1993) 
using  a  Weibull  based  methodology  of  a  discrete  stressed  volume  approach.  Briefly, 
the  method  establishes  a  reference  life,  Lre/,  a  reference  volume,  Vret,  and  a  reference 
stress,  Sre//  and  uses  shear  stress,  x,  results  from  finite  element  analysis  to  determine  the 
life,  L,  and  probability  of  survival,  S,  of  each  computed  element,  using  equations  10, 11, 
where  the  stress-life  exponent  c  and  Weibull  slope  e  are  material  specific.  The  authors 
used  the  element  with  the  highest  stress  as  the  reference  point. 


L  =  L 


ref 


(10) 
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The  life  and  probability  of  survival  can  be  obtained  for  each  mesh  element.  The 
probability  of  survival  S,  for  the  entire  engine  component  model  is  obtained  from 
multiplying  the  individual  survivabilities  (equation  12). 

5  =  f[Si  (12) 

n 

An  example  of  the  application  of  Probable  Cause  to  gas  turbine  engine  disks  is 
described  in  [Melis  and  Zaretsky  1999].  Finite  element  analysis  predicted  the  shear 
stress  distribution  for  the  disks.  A  Weibull  slope  of  two  was  chosen  for  the  failure 
distribution  requirement.  The  analysis  showed  the  bolthole  location  to  have  the 
highest  probability  of  failure,  in  agreement  with  experimental  results.  The  reference 
includes  values  of  input  parameters  and  results,  rarely  found  in  similar  papers. 
Calculations  for  the  material-life  factor  for  Ti-6A1-4V  from  experimental  results  have 
been  included.  The  effect  of  thermal  stresses  and  residual  stresses  on  disk  life  was 
discussed  but  was  not  included  in  the  analysis  due  to  lack  of  data. 

Many  computer  programs  use  Monte  Carlo  simulation  for  risk  assessment,  see  section 
3.2.  Ohnabe,  Funatogawa  and  Yang  (1985)  describe  the  application  of  Monte  Carlo 
simulation  for  probabilistic  fatigue  analysis  of  gas  turbine  engine  disks  under 
scheduled  inspection  maintenance  for  Retirement  For  Cause.  The  method  applied  to 
TF-33  jet  engine  disks,  used  a  stochastic  crack  growth  rate  model  and  implemented 
crack  growth  data  from  spin  pit  testing.  A  Monte  Carlo  simulation  of  5,000  runs 
showed  the  reliability  of  the  engine  components  to  increase  with  the  introduction  of 
scheduled  inspection  maintenance. 

Both  FORM  and  Monte  Carlo  computational  techniques  were  implemented  in  one 
application  of  fatigue  reliability  analysis  to  gas  turbine  engine  disks  [Cruse  et  al  1997]. 
In  this  example  FORM  calculations  were  used  in  a  sensitivity  analysis  that  determined 
the  significant  random  variables  affecting  the  fatigue  life  of  engine  disks.  This 
indicated  which  engine  variables  should  be  controlled  in  order  to  extend  the  disk  lives. 
Monte  Carlo  simulation  of  100,000  disks  for  a  number  of  discrete  time-dependent 
random  parameters  was  also  performed.  The  disk  fatigue  life  calculated  from  the  two 
techniques  differed,  and  reasons  justifying  the  results  are  given  in  the  report, 
indicating  once  again  the  importance  of  the  input  assumptions  for  reliability  models. 
The  system  risk  was  determined  for  a  two-stage  high-pressure  turbine  with  fatigue 
failure  at  four  locations.  The  assumption  was  that  system  failure  occurs  when  any  of 
the  four  locations  fail.  A  different  set  of  random  variables  affect  the  failure  mode  of 
each  location  and  thus  an  individual  performance  function  and  FORM  analysis  was 
developed  for  each  failure  mode.  The  system  failure  was  computed  as  the  union  of  the 
individual  failure  modes  and  the  sensitivity  analysis  indicated  the  random  variable 
most  influential  to  the  system  failure  probability.  This  is  a  very  good  example  of 
combining  analytical  engineering  and  probabilistic  analysis  in  reliability  of  engine 
components. 
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During  the  last  few  years  a  large  research  effort  has  been  undertaken  in  reliability 
analysis  to  determine  the  feasibility  of  utilising  ceramic  components  in  gas  turbines 
because  of  their  favourable  elevated  temperature  properties  [Duffy  et  al  1993a].  A 
large  number  of  papers  have  focused  on  the  applicability  of  R&R  methods  for  ceramic 
gas  turbine  components  [Nemeth  et  al  1990,  Duffy  et  al  1993a,  Duffy  et  al  1993b, 
Sturmer  et  al  1993,  Thomas  and  Wetherhold  1993,  Nemeth  et  al  1994,  Saith  et  al  1995, 
Salem  et  al  1995],  Ceramic  failure  has  been  described  as  a  probabilistic  event  due  to  the 
variation  of  inherent  flaw  size  and  the  consequent  large  variation  in  strength  [Powers 
et  al  1992]. 

The  Ceramics  Analysis  and  Reliability  Evaluation  of  Structures  (CARES/ Life)  program 
for  advanced  fast  fracture  reliability  has  been  used  by  a  number  of  researchers  to 
evaluate  the  reliability  of  ceramic  components  experiencing  thermomechanical  loading 
[Nemeth  et  al  1990,  Powers  et  al  1992,  Duffy  et  al  1993a,  Duffy  et  al  1993b,  Sturmer  et  al 
1993].  The  program  has  been  widely  distributed  to  US  research  and  government 
bodies.  CARES/Life  predicts  the  fast  fracture  reliability  of  laminated  ceramic  matrix 
composites,  for  a  chosen  flaw  shape  and  fracture  criterion.  The  program  utilises  a 
range  of  models  including  two-parameter  Weibull  distribution  for  component  strength 
variation  and  Paris  law.  Power  law  or  Walker  law  for  subcritical  crack  growth.  A 
number  of  methods  can  be  used  to  model  the  effects  of  multi-axial  stresses,  including 
the  principle  of  independent  action,  the  Weibull  normal  stress  averaging  or  Batdorf 
theory.  The  program  includes  a  database  of  material  properties  at  a  variety  of 
temperatures.  Details  of  the  models  employed  in  this  program  can  be  found  in 
[Nemeth  et  al  1990,  Powers  et  al  1992,  Nemeth  et  al  1994].  As  mentioned  by  Nemeth  et 
al  (1994)  there  are  many  potential  enhancements  to  this  program  including  the 
assessment  of  reliability  for  creep  and  oxidation  failure  modes. 

Cares/Life  has  been  applied  to  gas  turbine  disks  [DiMascio  et  al  1998]  and  metal- 
matrix  composites  [Zaretsky  1996],  One  application  to  turbine  disks  showed  the 
reliability  predictions  to  be  much  more  sensitive  to  the  accuracy  of  the  finite  element 
model  than  to  the  strength  of  the  material  parameters  [DiMascio  et  al  1998]. 

One  important  issue  for  the  reliability  analysis  of  ceramic  matrix  composites  materials 
is  the  size  effect  in  the  fibre  direction  of  a  unidirectional  material  [Duffy  et  al  1993a], 
The  choice  of  a  parallel  or  series  system  for  the  structure  is  not  straightforward, 
especially  when  the  material  properties  are  believed  to  be  dependent  on  the  test 
method  used.  There  is  concern  of  lack  of  experimental  data  that  would  validate 
reliability  programs  for  ceramics. 

Another  program  that  models  sub-critical  crack  growth  in  ceramics  is  described  in 
[Sturmer  et  al  1993],  The  program  determines  the  thermal  and  stress  distributions  and 
calculates  load  and  time-dependent  failure  probabilities.  One  example  of  a  gas  turbine 
component  showed  the  results  using  different  fracture  criteria  to  diverge  with 
increasing  time,  emphasising  the  importance  of  selecting  the  correct  fracture  criterion. 

SPSLIFE  is  another  program  used  for  the  design  assessment  of  ceramic  components  for 
fast  fracture,  slow  crack  growth,  creep  and  oxidation.  Results  of  the  application  of 
SPSLIFE  to  a  ceramic  gas  turbine  component  were  compared  to  results  from 
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CARES /Life  and  good  agreement  was  found  between  the  two  programs  [Saith  et  al 
1995]. 

5.2  Propulsion  systems 

The  Numerical  Evaluation  of  Stochastic  Structures  Under  Stress  (NESSUS)  computer 
program  has  been  developed  by  NASA  Lewis  Research  Centre  to  simulate  response  to 
uncertainties  in  structural  parameters  and  to  assess  the  reliability  and  risk  for 
structural  components  of  space  propulsion  systems.  It  provides  component  and 
system  risk  assessment  and  claims  to  be  "  the  first  major  probabilistic  finite  element 
program  that  could  solve  complicated  reliability  analysis  problems  such  as  a  turbine  blade  with 
multiple  failure  modes"  [Millwater  and  Wu  1992,  SRI  1999].  An  extensive  list  of  NESSUS- 
related  publications  is  found  in  [SRI  1999]. 

This  is  a  multi-functional  and  modular  program,  integrating  various  probabilistic  and 
finite  element  methods  and  utilises  a  number  of  probabilistic  methods  including 
Advanced  Mean  Value  and  Importance  Sampling  Method.  It  is  a  generic  program  and 
hence  is  applicable  to  any  propulsion  system  component.  The  Multi-Factor  Interaction 
Equation  (MFIE)  (Section  4.1)  is  used  to  simulate  material  property/ strength 
degradation  due  to  cyclic  loading  on  the  engine  component. 

NESSUS  has  been  applied  to  a  large  range  of  aerospace  structures  including  turbine 
blades  and  main  combustion  chamber,  investigating  the  high  cycle  and  low  cycle 
fatigue  response  of  these  systems.  A  summary  of  the  applications  is  given  in  [SRI 
1999]  a  number  of  applications  investigate  the  effect  of  thermal  loads  on  engine 
structures  utilising  a  thermal  analysis  code.  This  latter  feature  sets  NESSUS  as  a  more 
advanced  probabilistic  tool  compared  to  other  R&R  programs  that  cannot  implement 
thermal  effects  in  the  probabilistic  assessment. 

NESSUS  has  been  used  in  sensitivity  analyses  to  determine  the  dominant  variables 
affecting  the  reliability  of  the  Space  Shuttle  Main  Engine  turbine  blades  [Shah  et  al 
1992].  The  study  considered  the  centrifugal,  thermal  and  pressure  loads,  material 
properties  and  geometry  as  random  variables  expressed  by  probability  density 
functions.  The  application  emphasised  the  need  to  determine  the  fundamental 
mechanisms  that  govern  material  behaviour  to  produce  Multi-Factor  Interaction 
Equations. 

The  Probabilistic  Failure  Assessment_(PFA)  methodology,  described  by  Moore,  Ebbeler 
and  Creager  (1990, 1992),  uses  Monte  Carlo  simulation  to  determine  failure  analysis  for 
launch  propulsion  systems.  The  program  uses  a  Bayesian  statistical  framework  to 
combine  information  from  engineering  analysis  with  success/ failure  data  and  obtain  a 
failure  risk  estimate,  similar  to  the  method  described  for  gas  turbine  engine  disks 
[Singpurwalla  1988]. 

One  study  of  the  reliability  of  a  single-engine  aircraft  evaluated  the  Full  Authority 
Digital  Electronic  Control  system  [Hjelmgren  et  al  1998].  The  analysis  looked  at  faults 
of  electronic  parts  of  engines,  using  a  reliability  requirement  of  one  in  a  million  failures 
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per  flight  hour  as  specified  in  the  US  military  specification  MIL-F-9490.  A  comment 
was  made  of  the  lack  of  research  papers  on  engine  control  systems  compared  to  those 
for  aircraft  control  systems.  Some  aspects  of  this  study  are  of  interest  to  engine 
applications,  such  as  the  description  of  the  engine  control  systems  as  parallel  or  serial 
structures  and  the  calculation  of  the  probability  of  failure  using  the  Markov  chain 
method. 

5.3  Inspection  Maintenance 

ADF  interest  goes  beyond  risk  assessment  towards  the  requisite  management  of  risk. 
Moore,  Ebbeler  and  Creager  (1992)  state  that  there  are  three  options  available  when 
probabilistic  assessment  shows  the  risk  estimation  of  engine  components  to  be 
unacceptable.  It  is  possible  to: 

(i)  obtain  additional  information  to  improve  the  quality  of  the  product  (re¬ 
design), 

(ii)  life  limit  the  parts  and/or 

(iii)  increase  the  inspection  frequency. 

Re-design  and  life-limiting  the  parts  are  expensive  options  for  the  user  and  can  be 
avoided  with  the  introduction  of  inspection  intervals.  This  can  be  implemented  with 
the  assistance  of  R&R  programs. 

The  future  of  R&R  programs  appears  to  lie  in  the  application  of  risk  assessment  to  fleet 
risk  management  through  in-service  inspection  planning.  This  is  achieved  under  a 
retirement-for-cause  or  damage  tolerance  approach  to  component  life  management. 
Although  this  does  not  imply  replacing  the  safe  life  method,  it  can  be  used  to 
complement  it,  as  recommended  by  the  FAA  for  turbine  components  following  the 
Sioux  City  accident  [AIARI  Sub-Committee  1997]. 

Models  that  include  inspection  planning  have  been  applied  to  a  number  of  failure 
modes,  including  high  cycle  and  low  cycle  fatigue  and  stress  rupture  of  propulsion 
systems  [Moore  et  al  1990,  Safie  and  Hage  1991,  Wu  et  al  2000].  These  models 
recommend  inspection  of  components  at  a  specified  interval  and  if  a  certain  criterion  is 
met  their  removal.  Inspection  of  the  components  is  conducted  at  an  interval 
corresponding  either  to  a  critical  crack  size  [Safie  and  Hage  1991]  or  a  specified  risk 
limit  [Tong  and  Kappas  2001].  The  removal  of  components  can  be  based  on  a  POD 
curve  implemented  in  these  programs  [Wu  et  al  2000], 

Ohnabe,  Funatogawa  and  Yang  (1985),  describe  one  example  of  application  of  Monte 
Carlo  simulation  for  TF-33  jet  engine  disks  under  scheduled  inspection  maintenance. 
During  each  maintenance  inspection,  the  component  was  replaced  by  a  new  one  if  the 
crack  size  in  the  component  was  greater  than  a  specified  crack  size.  The  authors  state 
that  when  scheduled  inspection  maintenance  was  simulated  for  a  disk  that  had  a 
design  life  of  2,500  cycles,  the  disk  service  life  was  extended  to  12,500  cycles.  The 
results  of  the  simulation  showed,  that  the  probability  of  failure  decreased  and  the 
average  percentage  of  replacement  increased  as  the  number  of  inspections  increased.  It 
was  demonstrated  that  the  introduction  of  scheduled  inspection  maintenance  improves 
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the  reliability  of  engine  disks  in  service.  Similar  results  were  described  for  the 
assessment  of  turbine  wheels,  where  reliability  was  increased  at  a  lower  rejection  flaw 
size  and  decreased  at  longer  inspection  intervals  [Safie  and  Hage  1991]. 

The  computer  program  DARWIN  calculates  the  risk  of  disk  fracture  due  to  defects 
without  inspection  by  numerical  integration,  and  then  determines  the  risk  of  disk 
fracture  with  inspection  (equation  13).  Following  the  inspection  and  removal  of  disks, 
the  program  determines  the  new  probability  density  function  (PDF)  of  defect 
occurrence  (equation  14).  Application  to  industrial  cases  showed  the  probability  of 
failure  decreased  with  inspection  maintenance  [Wu  et  al  1999].  DARWIN  treats  the 
inspection  time  as  a  random  variable  described  by  a  normal  distribution. 

No.  of  failures  with  inspection  n  ,  > 

P,  (inspection)  =  P,  (no  inspection)  *  —  ~f 

Post  inspection  PDF  =  Pre  -  inspection  PDF  *  Probability  of  Non  Detection  (14) 

The  PRobability  Of  Fracture  (PROF)  program  has  been  applied  to  aging  aircraft  to 
determine  the  inspection  intervals  that  corresponded  to  acceptable  risk  of  failure  levels 
[Berens  1996].  A  cost  analysis  of  maintenance  costs  model  is  included  and  applications 
have  suggested  a  cost  benefit  when  shorter  inspection  intervals  are  applied  than  those 
determined  from  deterministic  damage  tolerance  analysis.  PROF  has  been  applied  to 
airframe  structural  components,  where  an  inspection  maintenance  approach  is  widely 
accepted.  A  similar  approach  for  engine  components  could  be  justified  if  the  cost 
benefit  can  be  demonstrated. 

5.4  Sensitivity  Analysis 

Researchers  often  state  that  a  sensitivity  analysis  in  reliability  studies  can  identify 
which  parameters  affect  the  system  response  the  most,  subsequently  removing  the 
non-important  ones  from  the  probabilistic  analysis  or  concentrating  effort  on  the  most 
influencial  [Cruse  et  al  1997,  Jeremic  and  Bengin  1998,  Robinson  1998].  The  relative 
influence  of  the  random  parameters  is  component  and  case  dependent.  According  to 
Moore  et  al  (1992),  a  probabilistic  risk  sensitivity  analysis  can  detect  sources  of 
unacceptable  failure  risk  requiring  corrective  action.  The  latter  can  be  achieved 
through  design  revision,  improvement  in  knowledge  of  the  load,  manufacturing 
process,  environment  and  material  behaviour  or  in  the  analytical  models. 

A  sensitivity  analysis  of  the  relative  importance  of  the  random  variables  used  in  fatigue 
reliability  is  described  in  Cruse  et  al  (1997).  The  method  determined  which  parameters 
were  most  influential  and  therefore  should  be  controlled  in  order  to  increase  the 
fatigue  life  of  gas  turbine  engine  disks.  The  random  variables  included  life,  mission 
and  engine  parameters.  It  was  concluded  that  one  particular  engine  parameter,  the 
burner  outlet  temperature  had  greater  influence  on  the  gas  turbine  disk  life.  Such  an 
investigation  can  assist  in  identifying  the  parameters  affecting  disk  life  which  may  be 
regarded  as  deterministic  in  the  risk  assessment  and  identify  which  ones  would  have 
to  be  represented  by  distribution  functions. 
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The  relative  effect  of  a  number  of  random  variables  on  the  prediction  of  a  corrosion- 
enhanced,  fatigue  crack  growth  model  was  investigated  in  a  sensitivity  analysis 
described  in  [Orisamolu  and  Luo  1997].  The  results  showed  that  the  reliability 
reduction  due  to  material  loss  from  corrosion  in  aging  aircraft  is  more  significant  than 
that  due  to  corrosion  enhanced  crack  growth  rates. 

A  sensitivity  analysis  using  the  program  DARWIN  determined  the  relevant  influence 
of  the  variability  in  each  of  the  Life  Scatter  factor.  Stress  Multiplying  factor,  defect  size 
and  disk  inspection  time  on  the  failure  probability  prediction  [Enright  and  Wu  2000]. 
The  defect  size  was  shown  to  have  the  dominant  influence  on  the  lifetime  reliability  of 
the  turbine  rotor  disks.  The  results  were  specific  to  an  idealised  rotor  disk  and  are 
expected  to  differ  for  an  in-service  component. 

The  use  of  a  spectrum  of  distribution  functions  allows  the  sensitivity  of  the  risk 
prediction  to  the  input  variables  to  be  determined.  This  has  been  recommended  as  a 
method  that  may  increase  the  confidence  in  reliability  methods  by  providing  a  range  in 
risk  output  when  all  possible  input  assumptions  are  covered  [Wu  and  Chen  1999], 

As  C.  Chamis,  Senior  Technologist  from  NASA  Glenn  Research  Lab,  stated  at  the 
PMC2001  [Chamis  and  Abumeri  2001],  the  costly  experiments  needed  for  defining 
probability  density  functions  can  and  should  be  avoided  by  quantifying  a  model's 
response  to  a  number  of  different  distribution  function  inputs.  Sensitivity  analysis 
thus  identifies  the  most  significant  system  parameters  for  a  subsequent  testing 
programme. 


6.  Further  research 


6.1  Engine  Component  and  System  Analysis 

The  risk  of  failure  of  an  entire  engine  system  cannot  be  easily  determined.  An  engine 
consists  of  a  number  of  critical  components  that  may  have  more  than  one  failure  mode. 
The  risk  of  failure  at  system  level  cannot  be  easily  quantified  and  limited  research  has 
been  conducted  for  engine  system  reliability.  Some  programs  previously  described 
treat  a  single  component  as  a  system  of  elements  and  determine  the  risk  at  the 
elemental  level. 

Cole  (1998)  describes  how  notional  reliability  targets  were  obtained  in  the  Failure 
Modes,  Effects  and  Criticality  Analysis  (FMECA)  for  an  engine  system.  An  estimate  of 
the  system  level  failure  rate  was  obtained  from  a  simple  addition  of  the  failure  rates  of 
each  component  of  the  system.  In  this  traditional  approach,  each  failure  rate  is  simply 
obtained  by  dividing  the  number  of  component  failures  by  the  total  operating  time. 
This  approach  assumes  the  availability  of  an  extensive  database  of  failure  history  of 
both  system  and  components.  It  also  implies  that  previous  component  history  can  be 
of  benefit  in  determining  the  average  failure  rate  for  the  system.  Such  an  approach 
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does  not  take  into  consideration  the  changes  in  operating  conditions,  which  would 
have  significant  influence  on  the  failure  response  of  the  system. 

As  mentioned  in  Shah  et  al  (1992),  different  models  for  integrating  component 
performance  with  failure  uncertainties  need  to  be  developed,  in  order  to  evaluate  the 
overall  system  reliability.  Such  models  must  account  for  multiple  failure  modes, 
interactions  between  different  components  and  must  evaluate  the  effect  of  individual 
component  performance  on  the  overall  system.  NESSUS  is  one  such  program  that  is 
being  expanded  to  incorporate  engine  system  risk  assessment  [SRI  1999]. 

The  system  reliability  problem  is  well  discussed  in  Cruse  et  al  (1997),  with  particular 
reference  to  the  issue  of  multiple  crack  initiation  in  gas  turbine  engine  disks.  The 
engine  is  described  as  a  system  of  parallel  or  series  networks.  A  series  or  weakest-link 
system  is  one  in  which  the  violation  of  any  one  of  the  design  limit  states  causes  system 
failure  and  the  probability  of  system  failure  is  computed  through  the  union  of  the 
individual  failure  events.  A  parallel  /  redundant  or  fail  safe  system  fails  only  when  all 
the  individual  modes  are  violated  and  the  probability  of  system  failure  is  the 
probability  of  joint  occurrence  of  all  the  individual  failure  events. 

However,  there  are  difficulties  associated  with  the  joint  probability  calculation  when 
non-linear  limit  states  exist.  The  existence  of  several  modes  of  failure  and  their 
influence  on  each  other  is  another  difficulty  in  calculating  the  system  reliability  of  gas 
turbine  engine  components.  Cruse  et  al  (1997)  present  a  study  of  a  high-pressure 
turbine  system  where  it  was  assumed  that  system  failure  occurred  when  any  of  four 
locations  failed.  Reliability  analysis  was  performed  on  each  of  the  four  individual 
failure  modes  and  the  overall  system  probability  of  failure  was  computed  from  the 
union  of  the  individual  reliability  results. 

The  survivability  of  an  engine  component  is  often  determined  at  the  elemental  level 
first,  as  with  the  programs  Probable  Cause  [Melis  and  Zaretsky  1999]  and  CARES/Life, 
or  at  the  zone  level,  as  with  the  program  DARWIN  [McClung  et  al  1999].  Once  the 
survivability  of  each  element  or  zone  is  determined,  the  probability  of  survival  for  the 
entire  engine  component,  S,  (Equation  15)  is  then  obtained  as  the  product  of  the 
individual  survivabilities,  assuming  a  series  reliability  system.  The  series  reliability 
model  accounts  for  the  failure  of  the  engine  component  when  any  of  the  locations 
defined  by  the  element  or  zone  in  the  component  fails. 

S  =  flS,  (15) 


DARWIN  determines  the  probability  of  failure  at  each  zone  in  the  component.  Pi,  and 
then  obtains  the  sum  for  the  component  probability  of  failure,  using  equation  16.  This 
assumes  that  failure  in  each  zone  is  independent  of  other  zones  and  the  individual 
probabilities  are  small,  (Appendix  1  provides  mathematical  explanation)  [Leverant  et  al 
1997]. 


i=n 

Ft=l.p< 


(16) 
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Competing  Risk  is  a  program  that  can  be  used  to  quantify  the  risk  of  failure  of 
commercial  engines  due  to  multiple  failure  modes.  Weibull  analysis  is  used  to 
determine  individual  Weibull  lines  for  the  failure  rates  of  each  in-service  problem  [Cole 
1998],  The  method  determines  the  system  risk  as  the  product  of  the  risks  due  to 
different  failure  modes.  The  author  cites  an  example  showing  how  the  system  failure 
rate  can  be  produced  for  an  engine  with  multiple  failure  modes.  According  to  the 
author,  the  method  used  for  commercial  engines  cannot  be  applied  to  military  gas 
turbine  engines  because  of  higher  component  complexity  and  limited  data  availability. 

Melis  and  Zaretsky  (1999)  discuss  the  reliability  and  lifing  issues  of  a  component  with 
multiple  failure  locations,  such  as  a  disk  with  many  boltholes.  The  disk  life  for  one  in  a 
thousand  failure  of  a  disk  with  multiple  boltholes  can  be  calculated  from  the  analytical 
prediction  of  a  disk  with  a  single  bolthole.  The  life  is  calculated  depending  on  the 
number  of  boltholes  n  and  the  Weibull  slope  /?  (Equation  17).  The  effect  of  a  multiple 
number  of  boltholes  is  to  decrease  the  life  at  which  one  in  a  thousand  disk  failures 
occur.  However,  there  is  no  evidence  in  the  literature  of  the  OEM  actually  using  this 
method  to  determine  the  safe  life  of  engine  disks. 


The  above  equation  may  have  application  in  the  case  of  multi  crack  initiation,  with  n 
being  the  number  of  sites  with  crack  initiation  in  the  same  disk.  Similarly,  it  may  be 
used  to  describe  any  series  reliability  system,  i.e.  the  effect  on  total  engine  life  when  a 
number  of  identical  critical  components  are  present.  The  development  of  system  risk 
models  for  military  engine  systems  will  need  to  consider  the  lack  of  substantial 
databases  and  the  complexity  of  jet  engine  systems.  Further  work  has  been  conducted 
in  DSTO  as  a  result  of  this  review,  in  the  determination  of  the  engine  system  risk  when 
multiple  critical  components  or  multiple  failure  modes  exist,  and  the  application  of  the 
DEFSTAN  00-971  risk  criteria  [Kappas  and  Antoniou,  2002], 


6.2  OEM  Collaboration 

It  is  encouraging  to  the  aircraft  and  aerospace  community  to  see  the  involvement  of 
aircraft  and  aerospace  engine  manufacturers  in  research  projects  that  aim  to  quantify 
the  risk  and  reliability  of  engine  structures.  This  sets  a  precedent  for  future  directions. 

The  FAA  sponsored  software  program  DARWIN,  the  product  of  a  four  year  FAA 
research,  engineering  and  development  grant  with  SwRI,  was  developed  in 
collaboration  with  engine  manufacturers  Honeywell,  Rolls-Royce-Allison,  General 
Electric  and  Pratt  &  Whitney.  The  program  has  been  granted  a  top  100  US  Research 
and  Development  award  for  2000  and  is  described  as  a  major  breakthrough  in  the 
FAA's  safety  research  programs  [Hughes  2000], 

DARWIN  has  received  strong  acceptance  by  most  turbine  engine  manufacturers 
worldwide.  This  is  a  positive  step  towards  improving  engine  lifing  methodologies  by 
allowing  risk  assessment  to  complement  the  traditional  safe  life  method.  It 
acknowledges  that  traditional  approaches  to  fatigue  lifing  of  gas  turbine  engine  disks 


32 


DSTO-TR-1306 


do  not  necessarily  consider  material  anomalies  that  may  have  catastrophic 
consequences.  This  FAA  sponsored  code  will  have  direct  implications  for  commercial 
engines  and  it  would  obviously  provide  a  precedent  for  military  engines. 

Probabilistic  Structural  Analysis  Methods  (PSAM)  is  the  research  and  technology 
project  undertaken  by  NASA-LeRC  and  is  sponsored  by  the  National  Aeronautical  and 
Space  Administration  [SRI  1999].  It  is  developed  in  order  to  increase  system  durability, 
assist  in  system  certification  of  space  propulsion  systems,  and  has  provided  tools  for 
low-cost  engine  design  and  development.  The  software  code  NESSUS  resulted  from 
this  sponsorship  and  the  collaborative  efforts  of  SwRI  and  Rocketdyne.  NESSUS  was 
completed  in  1995  and  made  available  for  component  and  system  risk  assessment  of 
space  propulsion  systems.  Rocketdyne  had  an  active  role  in  the  project,  validating  the 
applicability  of  the  code  to  the  design  of  future  engines. 

The  NESSUS  technology  has  been  applied  to  aerospace  propulsion  structures  by 
Rocketdyne  and  by  NASA,  SwRI  and  many  industries  to  other  structural  systems 
including  aircraft,  automotive  and  offshore  structures.  The  NESSUS  code  has 
stimulated  other  risk  code  developments  and  the  PSAM  project  has  made  valuable 
contributions  to  the  open  literature. 

These  two  examples  provide  excellent  precedents  for  the  involvement  of  OEMs  in  the 
development  of  R&R  tools  and  their  subsequent  application  to  aircraft  and  aerospace 

engine  systems. 

One  further  example  is  the  Disk  Optimisation  Program,  initiated  in  1990  by  the  U.S.  Air 
Force  Research  Laboratory  and  in  collaboration  with  engine  OEMs  (Pratt  &Whitney 
and  General  Electric)  to  promote  the  probabilistic  design  of  gas  turbine  engines,  in 
order  to  reduce  weight  and  improve  durability.  The  objective  was  to  incorporate 
guidelines  for  application  of  probabilistic  methods  to  the  design  of  gas  turbine  engines 
in  the  ENgines  Structural  Integrity  Program  (ENSIP)  by  2006.  An  example  of  the  cost 
effectiveness  of  the  program  was  given  at  the  PMC2001  conference,  where  the  LCF  life 
of  a  second  stage  fan  disk  extended  to  twice  the  limit  life  was  quoted  as  saving  US$148 
million  [Brown  2001].  The  use  of  the  'power  by  the  hour'  instead  of  the  engine 
ownership  approach  was  noted  in  the  same  conference  as  a  change  that  will  promote 
the  use  of  probabilistic  methods  in  the  design  of  engine  components.  This  is  because 
probabilistic  methods  are  seen  by  OEMs  as  a  tool  that  can  help  to  reduce  the  cost  of 
operating  engines. 


7.  Concluding  remarks 


There  are  several  current  activities  in  the  aerospace  industry  that  aim  to  reduce  the 
current  gap  between  the  risk  assumptions  of  the  safe  life  methodology,  the  military 
standards  and  the  operational  requirements  for  aircraft  gas  turbine  components.  These 
include  the  FAA  Titanium  Rotating  Components  Review  program,  the  U.S.  Air  Force 
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Blade  Optimisation  program  and  the  annual  FAA/Air  Force/NASA/Navy  workshops 
on  the  application  of  probabilistic  methods  to  gas  turbine  engines.  The  aim  of  these 
collective  activities  is  to  increase  the  capability  of  the  aerospace  industry  in 
probabilistic  methods  for  the  risk  and  reliability  assessment  of  critical  engine 
components. 

This  report  has  reviewed  the  issues  that  drive  the  change  away  from  a  deterministic 
towards  a  stochastic  approach  in  the  design  and  analysis  of  engine  component  lives. 
Alternative  lifing  approaches  that  incorporate  risk  and  reliability  methods  into  the 
management  of  military  engine  components  have  been  examined. 

The  availability  of  computer  programs  and  methods  for  the  risk  and  reliability 
assessment  of  gas  turbine  engine  components  has  been  addressed.  Of  particular 
interest  are  the  modular  programs  resulting  from  collaboration  between  research 
organisations  and  the  OEMs.  Some  of  these  programs  incorporate  an  inspection 
maintenance  approach  and  thus  have  potential  use  when  a  Retirement  for  Cause  or 
Damage  Tolerance  approach  is  adopted  for  engine  components. 

The  dependence  of  risk  and  reliability  assessment  on  the  availability  of  engine  data  has 
been  discussed.  This  is  a  fundamental  issue  for  gas  turbine  engines  where  thermal, 
manufacturing  and  machining  effects  on  material  properties  need  to  be  taken  into 
consideration  in  understanding  the  failure  modes.  For  gas  turbine  engines  with 
military  applications,  databases  describing  material  properties  of  alloys  are  not  widely 
available,  adding  further  difficulties  in  determining  the  probability  density  functions 
necessary  for  accurate  risk  and  reliability  assessments. 

The  review  has  referred  to  the  military  standards  in  determining  what  is  the  acceptable 
risk  of  failure  of  gas  turbine  engine  components.  Although  estimates  of  the  acceptable 
risk  are  given  in  UK  DEF  STAN  00-971,  other  standards  lack  quantified  risk  limits. 

It  is  evident  that  risk  assessment  of  gas  turbine  engine  components  using  probabilistic 
methods  is  attracting  considerable  interest  and  effort  in  the  military  aviation 
community  and  a  move  away  from  the  use  of  deterministic  methods  towards  the 
implementation  of  stochastic  approaches  in  engine  lifing  is  in  progress. 

The  report  has  highlighted  areas  in  need  of  further  research,  including  the  effects  of 
multiple  failure  modes  incorporating  creep  and  oxidation  effects  on  risk  of  failure  for 
engine  components,  and  the  development  of  engine  system  risk  models. 
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Appendix  1 


Series  Reliability  Model  for  Engine  Components 

Given  an  engine  component  can  be  broken  down  into  a  number  of  zones  or  elements  n, 
the  component  survivability,  Sc,  is  given  by  the  product  of  the  individual  survivabilities 
for  each  zone  or  element,  Si : 


sc =fp,  (i) 

/=! 

(equation  15,  section  6.1) 

The  probability  of  failure  of  the  component  is  given  by: 

Pc=l-Sc  (2) 

Substituting  for  probability  of  survival  of  each  element  and  assuming  that  the  failure 
events  are  independent,  (2)  becomes: 


j-c-i-n®.  <2)' 

1=1 

pc=i-n(i-^.)  (3) 


For  n=3,  to  simplify  the  example,  (3)  gives  when  expanded: 

pc  =  i  _  (i  _  px )  *  (1  -  p2 )  *  (1  -  P3 )  =  1  -  [1  -  />  -  P2  +  P,  P2  -  P3  + P2  P3  +  Pv P3  -  pv Pi  P3 1  (4) 

Assuming  that  Pi,  P2,  P3are  small,  their  product  will  be  negligible  and  (4)  simplifies  to: 

PC=P,+P2+P3  (5) 

For  n  zones  or  elements,  the  probability  of  failure  of  a  component  is  therefore  given  by: 

PC=S^  <6> 

1=1 

(equation  16,  section  6.1) 

A  thorough  study  of  engine  system  risk  issues  and  models  are  currently  undertaken  in 
DSTO  and  a  report  will  be  available  by  end  of  2002  [Kappas  and  Antoniou,  2002]. 
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